KGB RAT MaaS + Agentic AI Endpoint Takeover: OTX Pulse Analysis — Infostealer & Credential Theft Detection Pack

---
title: KGB RAT / njRAT-Family Telegram C2 Communication
id: 8f2a1c4e-9b7d-4e3a-a1c5-kgbrat000001
status: experimental
description: Detects non-Telegram processes initiating HTTPS connections to the Telegram Bot API, consistent with KGB RAT / njRAT-family C2 channel abuse.
author: Security Arsenal Threat Intelligence
references:
  - https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan
date: 2026/11/14
modified: 2026/11/14
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'api.telegram.org'
      - 'kgbrat.org'
      - '.m417z.com'
  filter_legit:
    Image|endswith:
      - '\Telegram.exe'
      - '\telegram.exe'
  condition: selection_domain and not filter_legit
falsepositives:
  - Legitimate Telegram desktop client (filtered by process name)
  - Internal tooling using Telegram notifications (tune per-environment)
level: high
---
title: KGB RAT Persistence via Registry Run Key or Suspicious Autoruns
id: 8f2a1c4e-9b7d-4e3a-a1c5-kgbrat000002
status: experimental
description: Detects registry Run key persistence writes from processes in user-writable or temp paths, a hallmark of njRAT/Bladabindi/KGB RAT family implants.
author: Security Arsenal Threat Intelligence
references:
  - https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan
date: 2026/11/14
modified: 2026/11/14
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_path:
    Details|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_sys:
    Image|startswith: 'C:\Windows\System32\'
  condition: selection_key and selection_path and not filter_sys
falsepositives:
  - Software installers registering updaters from ProgramData (allowlist known vendors)
level: high
---
title: Suspicious Spring Batch Job Submission on Exposed Tomcat
id: 8f2a1c4e-9b7d-4e3a-a1c5-cairn0000003
status: experimental
description: Detects Tomcat spawning command shells or script interpreters — behavior observed in the agentic AI (Cairn) takeover of an unauthenticated Spring Batch job-submission endpoint.
author: Security Arsenal Threat Intelligence
references:
  - https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
date: 2026/11/14
modified: 2026/11/14
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\tomcat9.exe'
      - '\tomcat8.exe'
      - '\tomcat.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Tomcat applications spawning shells should be explicitly inventoried and allowlisted
level: critical

// KGB RAT & Agentic AI Takeover — Unified Hunt (Microsoft Sentinel)
// Covers: Telegram C2, known KGB RAT infra, packed-payload execution, Tomcat child processes
let kgbrat_hashes = dynamic([
  "559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36",
  "581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45",
  "d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894",
  "d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62",
  "df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8",
  "836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7"
]);
let suspicious_c2 = dynamic(["kgbrat.org", "ntdoc.m417z.com", "api.telegram.org"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where TimeGenerated > ago(14d)
   | where RemoteUrl has_any (suspicious_c2)
   | where InitiatingProcessFileName !~ "Telegram.exe"
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType, HuntType="KGB RAT C2"),
  (DeviceProcessEvents
   | where TimeGenerated > ago(14d)
   | where SHA256 has_any (kgbrat_hashes)
   | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessAccountName, HuntType="KGB RAT Hash Match"),
  (DeviceProcessEvents
   | where TimeGenerated > ago(14d)
   | where InitiatingProcessFileName has_any ("tomcat", "java.exe", "javaw.exe")
   | where FileName has_any ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","curl.exe","wscript.exe")
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName, HuntType="Tomcat/Spring Batch Child Process")
| sort by TimeGenerated desc

# KGB RAT / njRAT-Family IOC Hunt — Security Arsenal
# Run elevated on endpoints. Checks persistence, packed-payload artifacts, Telegram C2, known infra.
$Report = @()

# 1. Known KGB RAT file hashes (from OTX pulse)
$Hashes = @(
  "559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36",
  "581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45",
  "d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894",
  "d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62",
  "df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8",
  "836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7"
)

# 2. Registry Run-key persistence (HKCU/HKLM) pointing to user-writable paths
$RunKeys = @(
  "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
  "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
  "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $RunKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Value -match "AppData|Temp|ProgramData|Users\\Public" -and $_.Name -notmatch "^PS"
      } | ForEach-Object {
        $Report += [PSCustomObject]@{Type="Persistence-RunKey"; Artifact="$key -> $($_.Name) = $($_.Value)"; Risk="HIGH"}
      }
    }
  }
}

# 3. Scheduled tasks executing from temp/user paths (njRAT-family fallback persistence)
Get-ScheduledTask | ForEach-Object {
  $t = $_
  $t.Actions | Where-Object { $_.Execute -match "AppData|Temp|Users\\Public" } | ForEach-Object {
    $Report += [PSCustomObject]@{Type="Persistence-ScheduledTask"; Artifact="$($t.TaskName) -> $($_.Execute)"; Risk="HIGH"}
  }
}

# 4. Live Telegram C2 / known KGB RAT infrastructure connections
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
  $c = $_
  try {
    $dns = (Resolve-DnsName -Name $c.RemoteAddress -ErrorAction SilentlyContinue).NameHost
  } catch { $dns = $null }
  $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue)
  if ($dns -match "telegram|kgbrat|m417z" -and $proc.ProcessName -notmatch "^Telegram$") {
    $Report += [PSCustomObject]@{Type="C2-Network"; Artifact="$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$dns]"; Risk="CRITICAL"}
  }
}

# 5. Hash sweep of common drop locations
$DropPaths = @("$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\Users\Public","C:\ProgramData")
foreach ($p in $DropPaths) {
  Get-ChildItem $p -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($Hashes -contains $h.ToLower()) {
      $Report += [PSCustomObject]@{Type="IOC-HashMatch"; Artifact="$($_.FullName) [$h]"; Risk="CRITICAL"}
    }
  }
}

# 6. Tomcat/Spring Batch exposure check (agentic AI vector)
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in 8080,8443,8009 } | ForEach-Object {
  $Report += [PSCustomObject]@{Type="Exposure-Tomcat"; Artifact="Listener on port $($_.LocalPort) (PID $($_.OwningProcess)) — verify Spring Batch endpoints require auth"; Risk="REVIEW"}
}

if ($Report) { $Report | Format-Table -AutoSize; $Report | Export-Csv ".\kgbrat_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation }
else { Write-Output "[+] No KGB RAT / agentic-AI artifacts detected on $env:COMPUTERNAME" }