Laravel Supply Chain Attack, SideCopy XenoRAT Campaign, & The Gentlemen RaaS: OTX Pulse Analysis

---
title: Potential Laravel Lang Backdoor Execution
id: 8c3f2d1a-1b4c-4a9e-9f0d-5e6f7a8b9c0d
description: Detects the execution of suspicious files associated with the Laravel Lang compromise (helpers.php or DebugChromium.exe) initiated by web server processes or developer environments.
status: experimental
date: 2026/05/31
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\php.exe'
            - '\php-cgi.exe'
            - '\node.exe'
    filter_legit:
        CommandLine|contains:
            - 'artisan'
            - 'composer'
    selection_malware:
        CommandLine|contains:
            - 'helpers.php'
            - 'DebugChromium.exe'
    condition: selection and not filter_legit and selection_malware
falsepositives:
    - Legitimate developer testing (rare)
level: high
---
title: SideCopy XenoRAT Spearphishing LNK Execution
id: 7d2e1c9b-0a3d-4f8e-b1e2-3c4d5e6f7a8b
description: Detects execution patterns associated with SideCopy campaigns: LNK files spawning mshta.exe to fetch HTA payloads.
status: experimental
date: 2026/05/31
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk:
        Image|endswith: '\explorer.exe'
        CommandLine|contains: '.lnk'
    selection_mshta:
        NewProcessName|endswith: '\mshta.exe'
        CommandLine|contains: '.hta'
    selection_remote:
        CommandLine|contains: 'http'
    condition: all of selection_*
falsepositives:
    - Low
level: critical
---
title: The Gentlemen Ransomware Go Binary Activity
id: 9f4e3d2c-2b5d-5a9f-c2f3-4d5e6f7a8b9c
description: Detects potential activity of The Gentlemen ransomware (Go-based) by identifying unsigned Go binaries performing rapid file modifications or encryption-like behavior.
status: experimental
date: 2026/05/31
author: Security Arsenal
tags:
    - attack.impact
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    selection_go:
        Company: ''
        Description: ''
        Image|endswith: '.exe'
    selection_crypto:
        CommandLine|contains:
            - 'xchacha20'
            - 'curve25519'
            - 'encrypt'
    selection_behavior:
        Image|contains:
            - '\Temp\'
            - '\AppData\'
    condition: selection_go and 1 of selection_*
falsepositives:
    - Other Go-based security tools
level: high

// Hunt for SideCopy LNK and MSHTA activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ((FileName == "explorer.exe" and ProcessCommandLine contains ".lnk") or (FileName == "mshta.exe" and ProcessCommandLine contains ".hta"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (DeviceNetworkEvents | where RemoteUrl has "abimj.edu.af") on DeviceName, Timestamp

// Hunt for Laravel Backdoor IOCs
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "helpers.php" or ProcessCommandLine has "DebugChromium.exe"
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine

// Hunt for The Gentlemen Ransomware File Hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in ("22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67", "fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68")
| project Timestamp, DeviceName, FileName, SHA256, InitiatingProcessAccountName

<#
.SYNOPSIS
    IOC Hunt Script for Laravel, SideCopy, and Gentlemen campaigns.
.DESCRIPTION
    Checks DNS cache for C2 domains and running processes for known malicious file hashes.
#>

$MaliciousDomains = @("flipboxstudio.info", "abimj.edu.af")
$MaliciousHashes = @(
    "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67",
    "fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68",
    "3b4194bdfe40d94031a94b30397ffd8a4b09d0a4057668e897b8bdcd1703dd01",
    "99127c8c67d90e2776beeb85281f9c68399bf4567b07a6b638d68b760212e88d"
)

Write-Host "[+] Checking DNS Cache for Malicious Domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } | Select-Object Entry, Data, Type

Write-Host "[+] Checking Running Processes for Malicious Hashes..." -ForegroundColor Yellow
$Processes = Get-Process
foreach ($Proc in $Processes) {
    try {
        $FullPath = $Proc.Path
        if ($FullPath -and (Test-Path $FullPath)) {
            $FileHash = (Get-FileHash -Path $FullPath -Algorithm SHA256).Hash.ToLower()
            if ($MaliciousHashes -contains $FileHash) {
                Write-Host "[!] ALERT: Malicious process detected: $($Proc.ProcessName) (PID: $($Proc.Id))" -ForegroundColor Red
                Write-Host "    Path: $FullPath" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access errors for system processes
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green