Kothamine RAT, Python MaaS Stealer Factory & ShinyHunters/UNC6240 PeopleSoft Exploitation: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Kothamine Agent C2 via Tailscale Tailcat
id: 9c4e2a1b-7d3f-4a5e-9b1c-kothamine001
status: experimental
description: Detects execution of Tailscale tailcat utility by non-standard parent processes or from unusual paths, consistent with Kothamine Agent RAT encrypted C2 abuse.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\tailcat.exe'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  condition: selection_img and (selection_suspicious_parent or selection_suspicious_path)
falsepositives:
  - Legitimate Tailscale administrative use by IT teams
level: high
tags:
  - attack.command_and_control
  - attack.t1105
  - attack.t1219
date: 2026/09/28
---
title: Python MaaS Infostealer Browser Credential Access
id: 7b1d3f2a-4c8e-4d2a-8e5b-maasstealer01
status: experimental
description: Detects unsigned or Python-compiled binaries (Nuitka/PyInstaller) accessing browser credential stores such as Chrome Login Data or cookies databases.
author: Security Arsenal
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
  selection_files:
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\Local State'
  filter_known_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\MsMpEng.exe'
  condition: selection_target and selection_files and not filter_known_browsers
falsepositives:
  - Legitimate backup or password management software
level: high
tags:
  - attack.credential_access
  - attack.t1555.003
date: 2026/09/28
---
title: UNC6240 PeopleSoft Web Shell and Tunneling Tool Deployment
id: 3e8a5c1d-2f6b-4a9c-b7d4-unc6240psoft1
status: experimental
description: Detects web server or Java processes spawning shells, MeshAgent, or proxy tooling consistent with SIDEEYE/Neo-reGeorg deployment following PeopleSoft CVE-2026-35273 exploitation.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\tomcat9.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\meshagent.exe'
      - '\meshagent64.exe'
      - '\netsh.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - PeopleSoft administrative scripts executed by application teams
level: critical
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1059
date: 2026/09/28

// Sentinel hunt: Kothamine tailcat C2, MaaS stealer execution, UNC6240 infrastructure & hashes
let ioc_hashes = dynamic(["ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0","74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c","2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d7","3ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3","419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c86","48b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494","ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07","429ed63ab3fbda8d22d0ac750ecfe8cc","610f0c65a3f8e88559f89ed90ea9ee5c","9ffe0e45c7a3f20e4481206c1c3b0854"]);
let ioc_ips = dynamic(["104.219.234.138"]);
let ioc_domains = dynamic(["azurenetfiles.net"]);
union isfuzzy=true
  (DeviceNetworkEvents
   | where TimeGenerated > ago(30d)
   | where RemoteIP in~ (ioc_ips) or RemoteUrl has_any (ioc_domains)
   | project TimeGenerated, DeviceName, ActionType, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource=tostring("Network-IOC")),
  (DeviceProcessEvents
   | where TimeGenerated > ago(30d)
   | where SHA256 in~ (ioc_hashes) or MD5 in~ (ioc_hashes)
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, MD5, InitiatingProcessFileName, DetectionSource=tostring("Hash-IOC")),
  (DeviceProcessEvents
   | where TimeGenerated > ago(30d)
   | where FileName =~ "tailcat.exe" and InitiatingProcessFileName has_any ("node.exe","npm.exe","cmd.exe","powershell.exe")
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource=tostring("Tailcat-Behavior")),
  (DeviceFileEvents
   | where TimeGenerated > ago(30d)
   | where FolderPath has_any ("\\Login Data","\\Cookies","\\Local State") and FolderPath has_any ("Chrome\\User Data","Edge\\User Data")
     and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","MsMpEng.exe")
   | project TimeGenerated, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, DetectionSource=tostring("BrowserCredAccess"))
| sort by TimeGenerated desc

# Kothamine / MaaS Stealer / UNC6240 endpoint IOC hunt — run via EDR live response or GPO
$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# 1) Running/network artifacts: Tailscale tailcat C2 and UNC6240 infrastructure
$conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '104.219.234.138' }
foreach ($c in $conns) { $Report += "NETCONN: $($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) PID=$($c.OwningProcess)" }

$tailcat = Get-Process | Where-Object { $_.Name -match 'tailcat' }
foreach ($p in $tailcat) { $Report += "PROCESS: tailcat running PID=$($p.Id) Path=$($p.Path)" }

# 2) Unsigned binaries in temp/user-writable paths (Nuitka/PyInstaller MaaS droppers)
$paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public","C:\ProgramData")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Include *.exe -ErrorAction SilentlyContinue | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') { $Report += "UNSIGNED-EXE: $($_.FullName) (SHA256: $((Get-FileHash $_.FullName -Algorithm SHA256).Hash))" }
  }
}

# 3) Persistence: Run keys and scheduled tasks referencing suspicious paths
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
  (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'Temp|AppData|Public|ProgramData|tailcat|meshagent' } |
    ForEach-Object { $Report += "RUNKEY: $k -> $($_.Name) = $($_.Value)" }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'Temp|AppData|Public|tailcat|meshagent' } |
  ForEach-Object { $Report += "SCHTASK: $($_.TaskName) -> $($_.Actions.Execute)" }

# 4) MeshAgent service presence (UNC6240 tooling)
$mesh = Get-Service | Where-Object { $_.Name -match 'mesh' }
foreach ($s in $mesh) { $Report += "SERVICE: $($s.Name) Status=$($s.Status)" }

# 5) DNS cache check for attacker domain
$dns = Get-DnsClientCache | Where-Object { $_.Entry -match 'azurenetfiles\.net' }
foreach ($d in $dns) { $Report += "DNSCACHE: $($d.Entry) -> $($d.Data)" }

$Report | Out-File "$env:TEMP\otx_hunt_2026-09-28.txt"
if ($Report.Count -gt 0) { Write-Host "[!] $($Report.Count) findings — see $env:TEMP\otx_hunt_2026-09-28.txt" } else { Write-Host "[+] No IOC artifacts found on this host." }