KarstoRAT Surveillance & ClickFix/CastleLoader Campaigns: OTX Pulse Analysis

title: Potential KarstoRAT UAC Bypass via FodHelper
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Detects the usage of fodhelper.exe to bypass UAC, a technique observed in the KarstoRAT campaign. Fodhelper is a LOLBin rarely used legitimately by end-users.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6262a8f0844f9a5b6c7d8e9f
tags:
    - attack.defense_evasion
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\fodhelper.exe'
    filter:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative use (rare)
level: high
---
title: Suspicious Finger.exe Execution (ClickFix/CastleLoader)
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
description: Detects the execution of finger.exe making network connections or spawned by cmd/powershell, indicative of the ClickFix campaign using finger.exe to retrieve payloads.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6273b9f19550b6c7d8e9f0a
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    condition: selection
falsepositives:
    - Legacy network administration tasks (very rare)
level: critical
---
title: Malicious Telnyx SDK Steganography Loader (TeamPCP)
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
description: Detects execution of msbuild.exe or python.exe loading suspicious WAV files or contacting typosquatted domains associated with the TeamPCP Telnyx SDK supply chain attack.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6284c0a20661c7d8e9f0a1b
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_msbuild:
        Image|endswith: '\msbuild.exe'
        CommandLine|contains: '.wav'
    selection_python:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'telnyx'
    condition: 1 of selection_*
falsepositives:
    - Legitimate development builds involving audio assets
level: high


kql
// KQL Hunt for KarstoRAT and ClickFix Indicators
// Hunt for specific C2 domains and IPs from the pulses
let IoC_Domains = dynamic(["aquasecurtiy.org", "trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com"]);
let IoC_IPs = dynamic(["212.227.65.132", "38.146.28.30"]);
// Hunt for FodHelper and Finger.exe abuse
let SuspiciousProcesses = dynamic(["fodhelper.exe", "finger.exe"]);
DeviceNetworkEvents
| where RemoteUrl in IoC_Domains or RemoteIP in IoC_IPs
| union (DeviceProcessEvents 
    | where FileName in SuspiciousProcesses 
    | where InitiatingProcessFileName !in~ ("explorer.exe", "services.exe"))
| project Timestamp, DeviceName, ActionType, FileName, RemoteUrl, RemoteIP, InitiatingProcessFileName, SHA256
| order by Timestamp desc


powershell
# PowerShell IOC Hunt Script for KarstoRAT & ClickFix
# Checks for file presence, network connections, and registry persistence

$MaliciousHashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a"
)

$C2_Domains = @("212.227.65.132", "38.146.28.30", "aquasecurtiy.org")

Write-Host "[+] Hunting for KarstoRAT and ClickFix artifacts..." -ForegroundColor Cyan

# 1. Check for Malicious Files in common temp/appdata directories
Write-Host "[*] Checking for malicious file hashes..." -ForegroundColor Yellow
$PathsToScan = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $MaliciousHashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 2. Check Network Connections to C2 Infrastructure
Write-Host "[*] Checking active network connections to known C2..." -ForegroundColor Yellow
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $C2_Domains -contains $_.RemoteAddress -or 
    ($_.OwningProcess -and (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName -match "(finger|fodhelper)")
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[!] SUSPICIOUS CONNECTION: RemoteIP=$($_.RemoteAddress) Process=$($proc.ProcessName) PID=$($_.OwningProcess)" -ForegroundColor Red
}

# 3. Check Run Keys for Persistence (Common with RATs)
Write-Host "[*] Checking Registry Run Keys for persistence..." -ForegroundColor Yellow
$RunPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Path in $RunPaths) {
    if (Test-Path $Path) {
        Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue | ForEach-Object {
            $_.PSObject.Properties | Where-Object {$_.Value -is [string] -and $_.Value -match ".(exe|bat|vbs|ps1)$"} | ForEach-Object {
                # Basic heuristic: check if file exists on disk for signed binaries, or obscure names
                $filePath = $_.Value -replace '^"', '' -replace '"$', ''
                if ($filePath -match "(BackgroundFix|NetSupport|Discord)") {
                    Write-Host "[!] SUSPICIOUS PERSISTENCE: $($_.Name) = $filePath" -ForegroundColor Red
                }
            }
        }
    }
}
Write-Host "[+] Hunt complete." -ForegroundColor Green