Kimwolf v7 IoT Botnet + Project CAV3RN Espionage Framework: OTX Pulse Analysis — Blockchain C2 & Google Apps Script Detection Pack

---
title: Kimwolf Botnet Ethereum Name Service C2 Resolution
id: 7f3a1c2e-4b5d-4e8a-9c1f-2d6e8a0b1c3d
status: experimental
description: Detects processes making JSON-RPC calls to public Ethereum RPC endpoints consistent with Kimwolf v7 ENS-based C2 resolution. Non-browser, non-wallet processes resolving ENS names are highly anomalous.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
references:
    - https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/
logsource:
    category: network_connection
    product: zeek
    service: json
    
detection:
    selection_rpc_method:
        jsonrpc.method|contains:
            - 'eth_call'
            - 'eth_getCode'
    selection_endpoint:
        dst_domain|contains:
            - 'eth.llamarpc.com'
            - 'cloudflare-eth.com'
            - 'rpc.ankr.com'
            - 'ethereum.publicnode.com'
            - 'mainnet.infura.io'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: selection_rpc_method and selection_endpoint and not filter_browsers
falsepositives:
    - Legitimate cryptocurrency wallet software or Web3 development tools
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568
---
title: HTTP/2 Flood With Browser Fingerprint Mimicry From Non-Browser Process
id: 8a4b2d3f-5c6e-4f9b-0d2e-3f7a9b1c2d4e
status: experimental
description: Detects rapid HTTP/2 request bursts carrying full browser User-Agent and header fingerprints originating from non-browser binaries, consistent with Kimwolf v7 DDoS tasking behavior on compromised IoT/Android devices relayed through enterprise segments.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
references:
    - https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/
logsource:
    category: proxy
    
detection:
    selection_ua:
        c-useragent|contains:
            - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
            - 'Mozilla/5.0 (Macintosh; Intel Mac OS X'
    selection_h2:
        cs-protocol: 'HTTP/2'
    timeframe: 60s
    condition: selection_ua and selection_h2 | count(dst_host) by src_ip > 200
falsepositives:
    - Load balancers, health-check services, and automated monitoring agents impersonating browsers
level: medium
tags:
    - attack.impact
    - attack.t1498
---
title: Project CAV3RN Google Apps Script C2 Relay or Suspicious Module Load
id: 9b5c3e4a-6d7f-4a0c-1e3f-4a8b0c2d3e5f
status: experimental
description: Detects CAV3RN-style C2 via Google Apps Script relay from non-browser processes, or loading of the framework's known module DLL names. CAV3RN selects Apps Script vs direct HTTPS per transaction based on DNS A-record responses.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
references:
    - https://securelist.com/project-cav3rn-continues/120991
logsource:
    category: network_connection
    product: windows
    
detection:
    selection_gas_relay:
        DestinationHostname|endswith:
            - 'script.google.com'
            - 'script.googleusercontent.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\brave.exe'
    selection_cav3rn_dns:
        DestinationHostname|endswith:
            - 'studiotikva.com'
    selection_module_load:
        ImageLoaded|contains:
            - '\GoogleService.dll'
            - '\CommunicationUxTheme.dll'
            - '\net.dll'
            - '\rnp.dll'
            - '\texture.dll'
    condition: (selection_gas_relay and not filter_browsers) or selection_cav3rn_dns or selection_module_load
falsepositives:
    - Enterprise automation legitimately calling Apps Script webhooks (rare from endpoints); third-party software shipping generic DLL names like net.dll — whitelist by signer and path
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
    - attack.persistence
    - attack.t1574.002

// Project CAV3RN + Kimwolf v7 — combined infrastructure & behavior hunt
// Sentinel: surface connections to known C2, ENS-RPC anomalies, and Apps Script relay usage
let cav3rn_domains = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com"]);
let cav3rn_ips = dynamic(["12.19.29.30", "12.121.234.120"]);
let kimwolf_ips = dynamic(["212.193.31.102"]);
let ens_rpc = dynamic(["eth.llamarpc.com", "cloudflare-eth.com", "rpc.ankr.com", "ethereum.publicnode.com", "mainnet.infura.io"]);
let browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
union isfuzzy=true
  // Direct C2 infrastructure hits
  (DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteIP in (cav3rn_ips) or RemoteIP in (kimwolf_ips)
        or RemoteUrl has_any (cav3rn_domains)
  | extend Signal = "Known C2 Infrastructure"),
  // CAV3RN: Google Apps Script relay from non-browser processes
  (DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteUrl has_any ("script.google.com", "script.googleusercontent.com")
  | where not(InitiatingProcessFileName in (browsers))
  | extend Signal = "Apps Script Relay (non-browser)"),
  // Kimwolf v7: ENS / Ethereum RPC resolution from non-browser processes
  (DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteUrl has_any (ens_rpc)
  | where not(InitiatingProcessFileName in (browsers))
  | extend Signal = "ENS-RPC Resolution (possible blockchain C2)"),
  // CAV3RN module DLL loads
  (DeviceImageLoadEvents
  | where TimeGenerated > ago(14d)
  | where FileName in~ ("GoogleService.dll", "CommunicationUxTheme.dll", "rnp.dll", "texture.dll")
  | extend Signal = "CAV3RN Module Load",
       RemoteIP = "", RemoteUrl = FolderPath)
| project TimeGenerated, Signal, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, RemoteIP, RemoteUrl, FileName, FolderPath, SHA256
| sort by TimeGenerated desc

# Security Arsenal — Kimwolf v7 / Project CAV3RN endpoint hunt
# Checks: known file hashes, CAV3RN module DLLs on disk, live C2 connections,
#         DNS cache for C2 domains, and Android-adjacent persistence artifacts.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Known malicious hashes (Kimwolf v7 payloads) ---
$badHashes = @(
  '421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca',
  '951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36'
)
$searchPaths = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA","C:\ProgramData","C:\Users\Public")
foreach ($p in $searchPaths) {
  Get-ChildItem -Path $p -Recurse -File -Include *.exe,*.dll,*.bin -Depth 3 | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($badHashes -contains $h) {
      $findings += [pscustomobject]@{Check='HashMatch'; Path=$_.FullName; Detail=$h}
    }
  }
}

# --- 2. CAV3RN module DLLs in suspicious locations ---
$modules = @('GoogleService.dll','CommunicationUxTheme.dll','rnp.dll','texture.dll')
foreach ($p in $searchPaths) {
  foreach ($m in $modules) {
    Get-ChildItem -Path $p -Recurse -Filter $m -Depth 3 | ForEach-Object {
      $findings += [pscustomobject]@{Check='CAV3RN-Module'; Path=$_.FullName; Detail=$m}
    }
  }
}

# --- 3. Live connections to known C2 ---
$c2 = @('212.193.31.102','12.19.29.30','12.121.234.120')
Get-NetTCPConnection -State Established | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess
  $findings += [pscustomobject]@{Check='C2-Connection'; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.Name)"}
}

# --- 4. DNS cache: CAV3RN infrastructure ---
Get-DnsClientCache | Where-Object { $_.Entry -match 'studiotikva\.com' } | ForEach-Object {
  $findings += [pscustomobject]@{Check='DNS-Cache'; Path='resolver-cache'; Detail="$($_.Entry) -> $($_.Data)"}
}

# --- 5. Non-browser processes talking to Google Apps Script (egress proxy check) ---
Get-NetTCPConnection -State Established | Where-Object RemotePort -in 80,443 | ForEach-Object {
  $ip = $_.RemoteAddress
  try { $name = ([System.Net.Dns]::GetHostEntry($ip)).HostName } catch { $name = '' }
  if ($name -match 'script\.google(usercontent)?\.com') {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc.Name -notmatch '^(chrome|msedge|firefox|brave)$') {
      $findings += [pscustomobject]@{Check='AppsScript-Relay'; Path=$proc.Path; Detail="$($proc.Name) -> $name ($ip)"}
    }
  }
}

# --- Report ---
if ($findings.Count -gt 0) {
  Write-Host "[!] $($findings.Count) suspicious artifact(s) found:" -ForegroundColor Red
  $findings | Format-Table -AutoSize
  $findings | Export-Csv -Path ".\kimwolf_cav3rn_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
} else {
  Write-Host "[+] No Kimwolf/CAV3RN artifacts detected on this host." -ForegroundColor Green
}