KGB RAT, KREMLIN, Variola & ARMORY CASTLE: OTX Pulse Analysis — Infostealer, Browser Hijack, and Zero-Day Exploitation Detection Pack

---
title: KGB RAT / Variola ClickFix PowerShell Execution Chain
id: 8f3a1c2e-7b4d-4e1a-9c6f-2d5a8b3e9f01
status: experimental
description: Detects ClickFix-style user-pasted PowerShell execution followed by suspicious child processes, consistent with Variola modular implant staging and KGB RAT loader delivery.
author: Security Arsenal Threat Intel
date: 2026/10/16
references:
  - https://blackpointcyber.com/blog/variola-from-clickfix-to-modular-implant/
  - https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'DownloadString'
      - 'IEX'
      - 'Invoke-Expression'
      - 'mshta'
      - 'hidden'
  filter_known:
    CommandLine|contains:
      - 'Chocolatey'
      - 'IntuneManagementExtension'
  condition: selection_parent and selection_image and selection_cli and not filter_known
fields:
  - CommandLine
  - ParentCommandLine
  - User
falsepositives:
  - Admin automation scripts pasted via Run dialog (rare)
  - Software deployment tooling
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204
---
title: Chromium Secure Preferences Tampering - KREMLIN Extension Forgery
id: 2b7d4e9a-5c1f-4a3b-8d2e-6f9a1c4b7e03
status: experimental
description: Detects non-browser processes modifying Chromium Secure Preferences or Preferences files, consistent with KREMLIN/REF9334 forging Chrome integrity checks to install malicious banking extensions.
author: Security Arsenal Threat Intel
date: 2026/10/16
references:
  - https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Local\BraveSoftware\'
      - '\AppData\Roaming\Opera Software\'
  selection_file:
    TargetFilename|endswith:
      - '\Secure Preferences'
      - '\Preferences'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection_path and selection_file and not filter_browsers
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Enterprise browser management/GPO sync tools
  - Backup agents (rare on live profile paths)
level: critical
tags:
  - attack.persistence
  - attack.t1176
  - attack.defense_evasion
---
title: KGB RAT Telegram C2 and Known C2 Infrastructure Communication
id: 4c9e2a1d-8f3b-4d6c-a1e5-7b2d9f4c8a06
status: experimental
description: Detects outbound connections to Telegram API from non-messenger processes (KGB RAT C2 pattern) or to known KGB RAT / PaperCut attacker infrastructure.
author: Security Arsenal Threat Intel
date: 2026/10/16
references:
  - https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan
logsource:
  category: network_connection
  product: windows
detection:
  selection_telegram:
    DestinationHostname|contains:
      - 'api.telegram.org'
  selection_c2_ip:
    DestinationIp:
      - '2.59.134.215'
      - '45.142.193.132'
  selection_c2_domain:
    DestinationHostname|contains:
      - 'kgbrat.org'
      - 'ntdoc.m417z.com'
      - 'codecaudiog.site'
      - 'codecvideowin.online'
  filter_known_clients:
    Image|endswith:
      - '\Telegram.exe'
      - '\telegram.exe'
  condition: (selection_telegram and not filter_known_clients) or selection_c2_ip or selection_c2_domain
fields:
  - Image
  - DestinationHostname
  - DestinationIp
  - DestinationPort
falsepositives:
  - Legitimate Telegram bots/integrations (filter by process allowlist)
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001

// Security Arsenal - Variola / KGB RAT / KREMLIN / ARMORY CASTLE Hunt
// Covers: ClickFix PowerShell staging, known C2 infra, Chrome preference tampering, SAWFLY/BARECLAW hashes
let C2IPs = dynamic(["2.59.134.215", "45.142.193.132"]);
let C2Domains = dynamic(["kgbrat.org", "ntdoc.m417z.com", "codecaudiog.site", "codecvideowin.online", "m417z.com"]);
let MalHashes = dynamic([
    "559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36",
    "581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45",
    "d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894",
    "d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62",
    "df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8",
    "12e7b2d8882e5376cb17d4f5d522d3ddae85e55c238a41391b5682e52483a00c",
    "2e77b5516d136a12d374b37371a35b6e9c8d452c84a33166dc22de12b2a8ff58",
    "1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462",
    "dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb",
    "c3f7109963b9599eb93fd9a97a4ffa38e672642b35b33608d69e6bbf9f19da4e",
    "14779d0d7ad6be3d7bf9ed78e4ab6016f22dfa7bc8b5d9c43b56011f7fe2ea19"
]);
union isfuzzy=true
    // Network: C2 infrastructure and Telegram API abuse from non-Telegram processes
    (DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteIP in (C2IPs) or RemoteUrl has_any (C2Domains)
       or (RemoteUrl has "api.telegram.org" and InitiatingProcessFileName !in~ ("Telegram.exe"))
    | project Hunt="C2_Communication", Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl),
    // Process: ClickFix-style PowerShell from Explorer with encoded/download cradles
    (DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where InitiatingProcessFileName in~ ("explorer.exe", "rundll32.exe")
    | where ProcessCommandLine has_any ("-enc", "FromBase64String", "DownloadString", "IEX", "Invoke-Expression", "mshta", "hidden")
    | project Hunt="ClickFix_PS_Execution", Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName),
    // File: non-browser process writing Chromium Secure Preferences (KREMLIN forgery)
    (DeviceFileEvents
    | where Timestamp > ago(30d)
    | where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\")
    | where FileName in~ ("Secure Preferences", "Preferences")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe")
    | project Hunt="Chromium_Prefs_Tamper", Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath),
    // File: known malware hashes (SAWFLY, BARECLAW, KGB RAT, Variola, PaperCut tooling)
    (DeviceFileEvents
    | where Timestamp > ago(30d)
    | where SHA256 in (MalHashes)
    | project Hunt="Known_Malware_Hash", Timestamp, DeviceName, FileName, FolderPath, SHA256)
| sort by Timestamp desc

# Security Arsenal - Endpoint IOC Hunt Script
# Targets: KGB RAT persistence, Variola config store, Telegram C2 connections, Chromium extension tampering
# Run elevated. Output: CSV of findings per host.

$Findings = @()

# 1) KGB RAT / njRAT-lineage persistence: suspicious Run keys and scheduled tasks
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $Key -Name $_.Name).($_.Name)
            if ($val -match "AppData|Temp|Public|powershell|\.vbs|\.js|regsvr32|rundll32") {
                $Findings += [PSCustomObject]@{Type="Persistence_RunKey"; Artifact="$Key\$($_.Name)"; Detail=$val}
            }
        }
    }
}
Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike "\Microsoft\*" -and
    ($_.Actions.Execute -match "powershell|wscript|mshta|rundll32" -or $_.TaskName -match "^\w{6,12}$")
} | ForEach-Object {
    $Findings += [PSCustomObject]@{Type="Persistence_SchedTask"; Artifact=$_.TaskName; Detail=$_.Actions.Execute}
}

# 2) Active network connections to known C2 / Telegram API
$BadIPs = @("2.59.134.215", "45.142.193.132")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($BadIPs -contains $_.RemoteAddress) {
        $Findings += [PSCustomObject]@{Type="C2_Connection"; Artifact=$_.RemoteAddress; Detail="Process: $($proc.Name) (PID $($_.OwningProcess))"}
    }
}
# Check DNS cache for C2 domains and Telegram API resolution by unusual processes
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match "kgbrat\.org|m417z\.com|codecaudiog\.site|codecvideowin\.online|api\.telegram\.org"
} | ForEach-Object {
    $Findings += [PSCustomObject]@{Type="DNS_C2_Lookup"; Artifact=$_.Entry; Detail=$_.Data}
}

# 3) Chromium Secure Preferences tampering (KREMLIN) - check for extensions dir + recent writes
$Profiles = Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data" -Directory -ErrorAction SilentlyContinue
foreach ($p in $Profiles) {
    $sp = Join-Path $p.FullName "Secure Preferences"
    if (Test-Path $sp) {
        $f = Get-Item $sp
        if ($f.LastWriteTime -gt (Get-Date).AddDays(-7)) {
            $Findings += [PSCustomObject]@{Type="Chromium_Prefs_RecentWrite"; Artifact=$sp; Detail="Modified $($f.LastWriteTime) - verify against Chrome uptime"}
        }
    }
    $extDir = Join-Path $p.FullName "Extensions"
    if (Test-Path $extDir) {
        Get-ChildItem $extDir -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $Findings += [PSCustomObject]@{Type="Chromium_Extension_Installed"; Artifact=$_.Name; Detail="$($_.FullName) - cross-check against enterprise allowlist"}
        }
    }
}

# 4) Variola-style encrypted config stores: recently created hidden files in AppData with high-entropy names
Get-ChildItem "$env:APPDATA","$env:LOCALAPPDATA" -Recurse -Force -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match "^[a-f0-9]{16,64}(\.(dat|bin|cfg|enc))?$" -and $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    ForEach-Object {
        $Findings += [PSCustomObject]@{Type="Suspicious_Config_Store"; Artifact=$_.FullName; Detail="Created $($_.CreationTime), $($_.Length) bytes"}
    }

# Output
if ($Findings.Count -gt 0) {
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv -Path "$env:TEMP\arsenal_ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($Findings.Count) findings exported." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators of KGB RAT / Variola / KREMLIN activity found on this host." -ForegroundColor Green
}