LabubaRAT, EtherHiding Blockchain C2 & PolinRider Supply Chain Campaign: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Three concurrent OTX pulses from 2026-09-18 collectively paint a picture of a threat landscape dominated by infrastructure-resilient intrusion sets that are deliberately engineering around traditional indicator-based blocking:

1. LabubaRAT — a custom, unsigned 64-bit Rust-based remote access trojan documented by Blackpoint Cyber that masquerades as legitimate NVIDIA software. It delivers full remote access capability: arbitrary command execution, file operations, screen capture, and SOCKS5 traffic proxying. Its configurable enrollment fields and internal ZM_ configuration namespace strongly suggest it is distributed under a Malware-as-a-Service (MaaS) framework, meaning multiple affiliates can operate independent campaigns with the same builder.

2. EtherHiding — an evolution of the technique first profiled in 2023, now matured into a full campaign active since November 2025. Operators store C2 addresses inside Polygon blockchain smart contracts rather than hardcoding them into payloads, enabling infrastructure rotation for pennies per update. The campaign has compromised at least 31 legitimate websites across multiple countries, using ClickFix / FakeCaptcha lures to trick finance-sector victims into self-executing malicious commands. The blockchain layer acts as a bulletproof dead-drop resolver.

3. PolinRider — a supply-chain infostealer operation that compromised a developer's GitHub account and inserted malicious code into development builds of visanduma/nova-two-factor, a Packagist package with over 700,000 downloads. The operators employ Git history rewriting to conceal commits, and the campaign spans npm, PyPI, Go modules, Packagist, and Chrome extensions — a cross-ecosystem developer-targeting effort aimed at harvesting credentials, tokens, and session data at scale.

Common thread: all three operations prioritize persistence of infrastructure and access over payload sophistication. LabubaRAT hides in plain sight behind a trusted vendor identity, EtherHiding makes its C2 effectively untakedownable via blockchain, and PolinRider converts trusted software distribution channels into the delivery vehicle. The strategic objective across all three is durable, stealthy access — for espionage, credential theft, or downstream monetization.

Threat Actor / Malware Profile

LabubaRAT (MaaS, Rust-based RAT)

• Distribution: Trojanized installers and binaries impersonating NVIDIA software (driver updaters, GPU utilities). Unsigned 64-bit Rust executables — no Authenticode chain to revoke, and Rust binaries evade many signature engines tuned for C/C++ compiler artifacts.
• Payload behavior: Command execution, file read/write/exfil, screen capture, and SOCKS5 proxying — the proxy function turns infected hosts into relay nodes, allowing operators to route additional traffic through victim networks and complicating attribution.
• C2 communication: Observed C2 IPs include 168.222.254.204, 191.44.109.130, 87.120.108.18 and domain pipicka.xyz.
• Persistence / config: Configurable enrollment fields and a ZM_-prefixed internal configuration namespace indicate a builder-generated binary — each affiliate's sample may carry unique mutexes, keys, and enrollment beacons, so hash-only detection will underperform.

EtherHiding (Blockchain-C2 / ClickFix loader chain)

• Distribution: Compromised legitimate websites (31+ confirmed) serving FakeCaptcha / ClickFix overlays that instruct victims to paste a malicious command into the Windows Run dialog or Terminal — a user-executed initial access technique that bypasses email gateways and attachment sandboxes entirely.
• C2 resolution: Payloads query public Polygon RPC endpoints (1rpc.io/matic, polygon.api.onfinality.io, polygon.lava.build) to read C2 addresses stored in smart contract storage. Blocking the 'C2' is futile — the contract persists on-chain; operators push a new address with a transaction costing fractions of a cent.
• Objective: Banking trojan delivery targeting the Finance sector. Pulse also references CVE-2023-0386, CVE-2023-4911 (Linux), CVE-2023-44487 (HTTP/2 Rapid Reset), and CVE-2024-6387 (regreSSHion) — suggesting a secondary exploitation or lateral-movement toolkit.

PolinRider (Cross-ecosystem supply-chain infostealer)

• Distribution: Compromised maintainer GitHub accounts; malicious code injected into dev branches of legitimate packages (visanduma/nova-two-factor). Git history rewriting (git push --force after rebase) erases forensic evidence of the malicious commits.
• Payload behavior: Infostealer focused on developer secrets — SSH keys, cloud tokens, .env files, browser credentials, and CI/CD secrets — the highest-value target set in any developer environment.
• C2 infrastructure: 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, with four SHA256 payload hashes published in the pulse.

IOC Analysis

The pulse indicator sets map to three distinct operationalization strategies:

Tooling: OTX DirectConnect or the OTXv2 Python SDK pulls these pulses into your SIEM. MISP ingestion via the OTX feed maps indicators to sightings. For the blockchain component, standard IOC tooling fails — you need behavioral correlation (process → RPC endpoint → subsequent C2 connection) rather than atomic indicator matching.

Detection Engineering

The following Sigma rules target the execution and C2 behaviors from all three pulses — ClickFix self-execution chains, LabubaRAT's NVIDIA masquerade and C2, PolinRider exfiltration, and anomalous Polygon RPC access from non-browser processes:

---
title: ClickFix FakeCaptcha User-Executed Command Chain
description: Detects ClickFix/FakeCaptcha social engineering where a browser spawns run-dialog or scripting interpreters, consistent with EtherHiding initial access
id: 9f1c2a44-6e51-4a3a-bb7d-ethclick0001
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate browser-launched installers (rare)
level: high
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059
---
title: LabubaRAT or PolinRider C2 Network Connection
description: Detects outbound connections to known LabubaRAT and PolinRider C2 infrastructure from OTX pulse indicators
id: 8a2d3b55-7f62-5b4b-cc8e-labpoli0002
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '168.222.254.204'
            - '191.44.109.130'
            - '87.120.108.18'
            - '166.88.134.62'
            - '23.27.13.135'
            - '166.88.73.46'
            - '193.247.144.38'
    selection_dns:
        QueryName|contains:
            - 'pipicka.xyz'
            - 'lanhd6549tdhse.top'
    condition: 1 of selection_*
falsepositives:
    - Threat intelligence validation traffic
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Suspicious Polygon RPC Access by Non-Browser Process - EtherHiding
description: Detects non-browser, non-wallet processes querying Polygon blockchain RPC endpoints, consistent with EtherHiding smart-contract C2 resolution
id: 7b3e4c66-8a73-6c5c-dd9f-polyrpc0003
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_dest:
        DestinationHostname|contains:
            - 'polygon.api.onfinality.io'
            - 'polygon.lava.build'
            - '1rpc.io'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_dest and not filter_browser
falsepositives:
    - Legitimate Web3 development tooling (hardhat, web3 scripts); whitelist dev workstations by user context
level: medium
tags:
    - attack.command_and_control
    - attack.t1102
date: 2026/09/18

This Microsoft Sentinel KQL query retro-hunts all pulse network indicators and correlates them with the responsible process, surfacing unsigned binaries (LabubaRAT trait) talking to known C2:

let C2IPs = dynamic(["168.222.254.204","191.44.109.130","87.120.108.18","166.88.134.62","23.27.13.135","166.88.73.46","193.247.144.38"]);
let SuspiciousDomains = dynamic(["pipicka.xyz","lanhd6549tdhse.top"]);
let PolyRPC = dynamic(["polygon.api.onfinality.io","polygon.lava.build","1rpc.io"]);
let BrowserProc = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
union
(DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (C2IPs) or RemoteUrl has_any (SuspiciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, RemoteIP, RemoteUrl, RemotePort, HitType="KnownC2"),
(DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (PolyRPC)
    | where not(InitiatingProcessFileName has_any (BrowserProc))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, RemoteIP, RemoteUrl, RemotePort, HitType="EtherHiding_RPC")
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, RemoteIP, RemoteUrl, HitType
| order by LastSeen desc

The following PowerShell hunt script sweeps endpoints for LabubaRAT/PolinRider artifacts — pulse file hashes, persistence keys, suspicious unsigned executables in NVIDIA-themed paths, and live C2 connections:

# Security Arsenal - OTX Pulse IOC Hunt (LabubaRAT / PolinRider / EtherHiding)
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Known malicious file hashes
$badHashes = @(
    'b7443b0ab48d2f5786d1b6f3a580f02621e9ae5a3877ee3a44e01df13d984328',
    '7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9',
    'b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3',
    'ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395',
    '139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683'
)
$scanPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:USERPROFILE\Downloads")
foreach ($p in $scanPaths) {
    Get-ChildItem $p -Recurse -File -Include *.exe,*.dll | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($badHashes -contains $h) {
            $report += [pscustomobject]@{Check='HashMatch'; Detail=$_.FullName; Severity='CRITICAL'}
        }
    }
}

# 2. Unsigned executables masquerading as NVIDIA (LabubaRAT trait)
Get-ChildItem "$env:ProgramFiles","$env:ProgramData","$env:LOCALAPPDATA" -Recurse -File -Include *nvidia*,*nv*.exe | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
        $report += [pscustomobject]@{Check='UnsignedNVIDIAMasquerade'; Detail="$($_.FullName) [Sig:$($sig.Status)]"; Severity='HIGH'}
    }
}

# 3. Active connections to C2 infrastructure
$c2 = @('168.222.254.204','191.44.109.130','87.120.108.18','166.88.134.62','23.27.13.135','166.88.73.46','193.247.144.38')
Get-NetTCPConnection -State Established | Where-Object { $c2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [pscustomobject]@{Check='LiveC2Connection'; Detail="$($proc.ProcessName) ($($proc.Path)) -> $($_.RemoteAddress):$($_.RemotePort)"; Severity='CRITICAL'}
}

# 4. DNS cache hits for malicious domains / RPC endpoints
Get-DnsClientCache | Where-Object { $_.Entry -match 'pipicka\.xyz|lanhd6549tdhse\.top|onfinality\.io|lava\.build|1rpc\.io' } | ForEach-Object {
    $report += [pscustomobject]@{Check='DNSCacheHit'; Detail=$_.Entry; Severity='HIGH'}
}

# 5. Persistence: Run keys with suspicious or unsigned binaries
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object {
        if ($_.Value -match '\.exe') {
            $exe = ($_.Value -replace '"','' -split ' ')[0]
            $sig = Get-AuthenticodeSignature $exe
            if ($sig.Status -ne 'Valid' -and (Test-Path $exe)) {
                $report += [pscustomobject]@{Check='UnsignedRunKeyPersistence'; Detail="$k -> $($_.Name): $($_.Value)"; Severity='HIGH'}
            }
        }
    }
}

# 6. Developer secret exposure check (PolinRider target set)
$secretPaths = @("$env:USERPROFILE\.ssh","$env:USERPROFILE\.aws\credentials","$env:USERPROFILE\.npmrc","$env:USERPROFILE\.config\gh")
foreach ($s in $secretPaths) { if (Test-Path $s) { $report += [pscustomobject]@{Check='DevSecretsPresent-RotationAdvised'; Detail=$s; Severity='INFO'} } }

$report | Sort-Object Severity | Format-Table -AutoSize
if (-not $report) { Write-Host '[+] No pulse indicators found on this host.' -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours)

• Push all 7 C2 IPv4 addresses and both malicious domains to egress firewall, proxy, and DNS sinkhole blocklists.
• Deploy the three Sigma rules and the Sentinel KQL query; run a 30-day retro-hunt across all endpoints and NetFlow.
• Sweep package caches (vendor/, node_modules, pip/Go module caches) for the four PolinRider SHA256 hashes; pin visanduma/nova-two-factor to a known-good release and audit lockfiles for dev-branch references.
• Search proxy logs for ClickFix staging domains and any user-initiated powershell/mshta execution chain originating from browsers.

24 Hours

• Credential rotation at developer scale: PolinRider is an infostealer — assume any host with a hash or C2 hit has leaked SSH keys, cloud tokens, npm/Packagist/GitHub tokens, and browser session cookies. Force rotation and revoke active sessions. Invalidate GitHub personal access tokens and enable enforced SSO.
• Audit GitHub audit logs for force-pushes, history rewrites, and anomalous maintainer logins on organization repositories.
• Verify finance-sector-facing web assets for unauthorized script injection (EtherHiding compromised 31+ legitimate sites — your CMS could be one).
• Identity verification: review IdP sign-in logs for impossible travel or token replay from hosts that queried pipicka.xyz or the PolinRider C2 range.

1 Week

• Architecture hardening against blockchain C2: implement egress filtering that restricts Polygon/Ethereum RPC endpoints to an allowlist of developer/build identities; alert on all other clients.
• Deploy application control (WDAC/AppLocker) blocking unsigned executables in user-writable directories — this kills LabubaRAT's unsigned-Rust delivery model and ClickFix paste-execution payloads.
• Enforce Sigstore/cosign or hash-pinning for all third-party packages; require provenance attestations for Packagist/npm/PyPI dependencies; gate dev-branch installs behind change review.
• Patch validation sprint against CVE-2024-6387 (OpenSSH), CVE-2023-4911 (glibc), CVE-2023-44487 (HTTP/2), and CVE-2023-0386 (OverlayFS) on all internet-facing Linux estate.
• Add ClickFix/FakeCaptcha lure awareness to the security training program — this technique defeats technical controls by design; the human is the last control.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub