KarstoRAT, MioLab & ClickFix Campaigns: Multi-Platform Infostealer Surge

title: Potential KarstoRAT C2 Communication
id: 4a8f9c2b-1d3e-4f5a-9b6c-7d8e9f0a1b2c
description: Detects HTTP connections to known KarstoRAT C2 infrastructure or specific User-Agent patterns associated with the malware.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660f0e3e8f7d9b12e1c0f9e8
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationPort:
            - 80
            - 443
        DestinationIp:
            - '212.227.65.132'
    condition: selection
falsepositives:
    - Legitimate traffic to the specific IP (unlikely if reserved for C2)
level: high
tags:
    - c2
    - infostealer
    - karstorat
---
title: Suspicious Finger.exe Execution (ClickFix Indicator)
id: 5b9g0d3c-2e4f-5g6b-0c7d-8e9f1a2b3c4d
description: Detects the execution of finger.exe, which is rarely used legitimately in modern environments and is a specific indicator for ClickFix/BackgroundFix social engineering campaigns.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6610f0e3e8f7d9b12e1c0f9e9
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\finger.exe'
    condition: selection
falsepositives:
    - Legacy system administration (rare)
level: critical
tags:
    - execution
    - social_engineering
    - clickfix
---
title: Python SDK Supply Chain Compromise (TeamPCP)
id: 6c0h1e4d-3f5g-6h7c-1d8e-9f0a2b3c4d5e
description: Detects Python.exe spawning msbuild.exe or loading suspicious WAV files, indicative of the TeamPCP Telnyx SDK supply chain attack using steganography.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6621f0e3e8f7d9b12e1c0f9ea
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith: '\\python.exe'
    selection_child:
        Image|endswith:
            - '\\msbuild.exe'
            - '\\powershell.exe'
            - '\\cmd.exe'
    selection_stego:
        CommandLine|contains: '.wav'
    condition: 1 of selection*
falsepositives:
    - Legitimate developer build environments
level: high
tags:
    - supply_chain
    - execution
    - steganography


kql
// KQL Hunt for ClickFix and KarstoRAT Activity
// Hunt for suspicious process execution and network connections
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("finger.exe", "msbuild.exe", "python.exe") or ProcessCommandLine has_any ("212.227.65.132", "finger.exe", ".wav")
| extend DeviceName = DeviceName, AccountName = InitiatingProcessAccountName
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| sort by Timestamp desc
;
// Hunt for Network IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com", "aquasecurtiy.org", "chatgptforchrome.com", "officerelaxation.com", "approve-me.com") 
   or RemoteIP in~ ("38.146.28.30", "212.227.65.132")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| sort by Timestamp desc


powershell
# PowerShell Hunt Script for Infostealer Artifacts
# Checks for presence of KarstoRAT and ClickFix related file hashes and paths

$TargetHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a"
)

Write-Host "[+] Hunting for Infostealer Artifacts..." -ForegroundColor Cyan

# Scan User AppData Directories (Common for stealers)
$PathsToScan = @("C:\Users\*\AppData\Roaming\", "C:\Users\*\AppData\Local\Temp\")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($FileHash -in $TargetHashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (Hash: $FileHash)" -ForegroundColor Red
            }
        }
    }
}

# Check for KarstoRAT C2 Connection indicators in DNS Cache (if accessible)
Write-Host "[+] Checking DNS Cache for KarstoRAT C2..." -ForegroundColor Yellow
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Data -eq "212.227.65.132" } | ForEach-Object {
    Write-Host "[!] SUSPICIOUS DNS RESOLUTION: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}