JADEPUFFER ENCFORGE Ransomware & Kimsuky BirdTroy/DriveTroy: OTX Pulse Analysis

title: Potential JADEPUFFER Langflow Exploit CVE-2025-3248
id: 7a3b5c1d-8e9f-4a0b-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects potential exploitation attempts of CVE-2025-3248 against Langflow infrastructure.
author: Security Arsenal
date: 2026/07/21
logsource:
    category: web
    product: apache
detection:
    selection:
        c-uri|contains: '/api/v1/'
        cs-method: POST
    filter:
        c-uri|contains: 'health'
    condition: selection and not filter
fields:
    - src_ip
    - dest_ip
    - url
    - user_agent
falsepositives:
    - Legitimate API usage of Langflow
level: high

---
title: Kimsuky DriveTroy Google Drive C2 Activity
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects processes utilizing Google Drive endpoints suspiciously, indicative of DriveTroy malware abuse.
author: Security Arsenal
date: 2026/07/21
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|endswith: '.googleusercontent.com'
        Initiated: 'true'
    filter_legit:
        Image|endswith:
            - '\GoogleDriveFS.exe'
            - '\googledrivesync.exe'
            - '\chrome.exe'
            - '\msedge.exe'
    condition: selection and not filter_legit
fields:
    - User
    - Image
    - DestinationHostname
falsepositives:
    - Custom scripts interacting with Google Drive API
level: medium

---
title: Kimsuky BirdTroy QUIC Protocol Usage
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects usage of HTTP/3 (QUIC) protocol to non-standard endpoints, characteristic of BirdTroy C2.
author: Security Arsenal
date: 2026/07/21
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Protocol|contains: 'QUIC'
    filter_common:
        DestinationHostname|endswith:
            - '.google.com'
            - '.googlevideo.com'
            - '.youtube.com'
            - '.facebook.com'
            - '.cloudflare.com'
    condition: selection and not filter_common
fields:
    - SourceIp
    - DestinationIp
    - DestinationHostname
level: high

// Hunt for JADEPUFFER and Kimsuky Indicators
let IOCs = dynamic(["45.131.66.106", "commit.hanbiro.o-r.kr", "node828765.dwservice.net", "node896147.dwservice.net", "dwservice.net"]);
let JADEPUFFER_HASHES = dynamic(["8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2", "ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a", "ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328"]);
let KIMSUKY_HASHES = dynamic(["84e9b066bebd49036b7fc71b5f5f8d83", "a452a860f973c7a43ea804c17e9427d2", "aa61e76255a6e13313439655bc02bdf5", "b1c72139f2cdd9419562369fc6ced4fc"]);

// Network Connections
DeviceNetworkEvents
| where RemoteIP in (IOCs) or RemoteUrl has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| extend Threat = case(RemoteIP == "45.131.66.106", "JADEPUFFER", RemoteUrl has "dwservice.net", "Kimsuky", "Unknown")
| order by Timestamp desc

// File Artifacts
union (
    DeviceFileEvents
    | where SHA256 in (JADEPUFFER_HASHES) or MD5 in (KIMSUKY_HASHES)
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5, AdditionalFields
    | extend Threat = case(SHA256 in (JADEPUFFER_HASHES), "JADEPUFFER", MD5 in (KIMSUKY_HASHES), "Kimsuky", "Unknown")
)

<#
.SYNOPSIS
Hunt script for JADEPUFFER ENCFORGE and Kimsuky Gomir Variants (BirdTroy/DriveTroy).
#>

$JADEPUFFER_HASHES = @(
    "8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2",
    "ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a",
    "ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328"
)
$KIMSUKY_HASHES = @(
    "84e9b066bebd49036b7fc71b5f5f8d83", "a452a860f973c7a43ea804c17e9427d2",
    "aa61e76255a6e13313439655bc02bdf5", "b1c72139f2cdd9419562369fc6ced4fc"
)
$BAD_HOSTS = @("45.131.66.106", "dwservice.net", "hanbiro.o-r.kr")

Write-Host "[*] Starting hunt for JADEPUFFER and Kimsuky artifacts..." -ForegroundColor Cyan

# Check for known file hashes
Write-Host "[+] Checking file system for known malicious hashes..." -ForegroundColor Yellow
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($Drive in $Drives) {
    Get-ChildItem -Path $Drive -Recurse -Include *.exe,*.dll,*.bin -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $hashSHA256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
            if ($JADEPUFFER_HASHES -contains $hashSHA256) {
                Write-Host "[!] ALERT: JADEPUFFER ENCFORGE SHA256 Match found: $($_.FullName)" -ForegroundColor Red
            }

            $hashMD5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash
            if ($KIMSUKY_HASHES -contains $hashMD5) {
                Write-Host "[!] ALERT: Kimsuky Gomir Variant MD5 Match found: $($_.FullName)" -ForegroundColor Red
            }
        } catch {
            # Ignore access errors
        }
    }
}

# Check network connections
Write-Host "[+] Checking active network connections..." -ForegroundColor Yellow
$TCPConnections = Get-NetTCPConnection -State Established,Listen -ErrorAction SilentlyContinue

foreach ($Conn in $TCPConnections) {
    $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
    if ($Process) {
        $RemoteIP = (Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {$_.Data -eq $Conn.RemoteAddress}).Name
        if (-not $RemoteIP) { $RemoteIP = $Conn.RemoteAddress }
        
        if ($BAD_HOSTS -contains $Conn.RemoteAddress -or $RemoteIP -match 'dwservice|hanbiro') {
            Write-Host "[!] ALERT: Suspicious connection to $($Conn.RemoteAddress) by $($Process.ProcessName) (PID: $($Conn.OwningProcess))" -ForegroundColor Red
        }
    }
}

Write-Host "[*] Hunt complete." -ForegroundColor Cyan