Larva-24009 (HeptaX) Phishing Campaign: QuasarRAT & UltraVNC Deployment — Healthcare Sector Threat Analysis | Security Arsenal

Threat Summary

The Larva-24009 threat actor (also known as HeptaX) has been conducting persistent phishing email campaigns since 2023, with continued activity through 2026. Their primary targets include healthcare enterprises globally, particularly in Korea. The attack vector involves LNK files disguised as legitimate documents with themes such as hospital surveys, blockchain initiatives, project proposals, and resumes. Upon execution, these LNK files trigger obfuscated PowerShell commands that deploy multiple backdoors including QuasarRAT, UltraVNC, and Notifier malware. The campaign objectives appear to be credential theft, remote access capabilities, and long-term persistence within targeted healthcare environments.

Threat Actor / Malware Profile

Larva-24009 (HeptaX) is an established threat actor known for sophisticated phishing campaigns targeting enterprise sectors:

Distribution Method: Primarily through email attachments containing LNK files masked as documents with healthcare and business-related themes
Payload Behavior:
- QuasarRAT: A remote access trojan that provides full control over infected systems, including file management, process control, and keylogging
- UltraVNC: A legitimate remote desktop tool weaponized for unauthorized remote access
- Notifier: Malware that maintains communication with C2 infrastructure and sends system information
C2 Communication: Connections to command and control servers at pozeny.shop and aonexa.shop via IP 217.77.6.50
Persistence Mechanism: Likely through scheduled tasks or registry modifications established by the initial PowerShell payloads
Anti-Analysis Techniques: Use of obfuscated PowerShell scripts to evade detection and analysis

IOC Analysis

The pulse provides critical indicators for detection and hunting:

Domains: pozeny.shop and aonexa.shop are likely C2 domains; network telemetry should be scrutinized for any connections to these addresses
IPv4: 217.77.6.50 should be blocked at perimeter firewalls and monitored for any connection attempts
File Hashes (MD5): 5 file hashes provided are for malware payloads; EDR solutions should be configured to detect and quarantine these specific hashes
Tooling for Operationalization: These IOCs can be integrated into SIEM platforms for correlation with endpoint telemetry, and into firewall/EDR blocklists. YARA rules can be created based on the file characteristics.

Detection Engineering

Sigma Rules

YAML

---
title: Suspicious PowerShell via LNK Execution
id: ebd83290-2f23-4e14-b2a3-877d1b5f0d5e
description: Detects execution of obfuscated PowerShell commands initiated from LNK files, consistent with Larva-24009 TTPs
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
    - https://asec.ahnlab.com/en/94786/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.initial_access
    - attack.t1566.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains: 
            - 'EncodedCommand'
            - 'FromBase64String'
    filter_legit:
        ParentProcessName|endswith:
            - '\explorer.exe'
            - '\services.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administration tasks
level: high

---
title: Larva-24009 C2 Network Connections
id: f7e2a91b-4d5c-4593-b823-e5af12345678
description: Detects network connections to known Larva-24009/HeptaX C2 infrastructure
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
    - https://asec.ahnlab.com/en/94786/
tags:
    - attack.command_and_control
    - attack.c2
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname:
            - 'pozeny.shop'
            - 'aonexa.shop'
        DestinationIp:
            - '217.77.6.50'
    condition: selection
falsepositives:
    - None expected
level: critical

---
title: QuasarRAT Service Installation
id: c3d4e5f6-7890-abcd-ef12-34567890abcd
description: Detects creation of services consistent with QuasarRAT installation
status: experimental
author: Security Arsenal
date: 2026/08/04
references:
    - https://asec.ahnlab.com/en/94786/
tags:
    - attack.persistence
    - attack.t1543.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains:
            - 'Quasar'
            - '\Temp\'
    condition: selection
falsepositives:
    - Legitimate software installations
level: medium

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for connections to known Larva-24009 C2 infrastructure
DeviceNetworkEvents
| where RemoteUrl in ("pozeny.shop", "aonexa.shop") or RemoteIP == "217.77.6.50"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| sort by Timestamp desc

// Hunt for suspicious PowerShell execution from LNK files
DeviceProcessEvents
| where ProcessVersionInfoProductName == "Microsoft Windows PowerShell" or FileName =~ "powershell.exe"
| where ProcessCommandLine contains "EncodedCommand" or ProcessCommandLine contains "FromBase64String"
| where InitiatingProcessFileName endswith ".lnk"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessSHA256
| sort by Timestamp desc

// Hunt for creation of suspicious files with known Larva-24009 hashes
DeviceFileEvents
| where SHA256 in ("10b40185106eb3760cb71c46117aa0bf", "1500fefcdda275b70e2051a3e7d9f794", "2973fda8d0d0fa0200a05889fce85df6", "444fb3592cd1848660259a913684795b", "4ad28d0313549e98383144d82982be6e")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| sort by Timestamp desc

PowerShell Hunt Script

PowerShell

# Larva-24009/HeptaX IOC Hunter
# This script hunts for artifacts associated with Larva-24009 campaign

# Known Larva-24009 IOCs
$domains = @("pozeny.shop", "aonexa.shop")
$ip = "217.77.6.50"
$hashes = @(
    "10b40185106eb3760cb71c46117aa0bf",
    "1500fefcdda275b70e2051a3e7d9f794",
    "2973fda8d0d0fa0200a05889fce85df6",
    "444fb3592cd1848660259a913684795b",
    "4ad28d0313549e98383144d82982be6e"
)

# Check for network connections to C2 domains
Write-Host "Checking for network connections to known Larva-24009 C2 infrastructure..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection | Where-Object {
    $_.RemoteAddress -eq $ip -or 
    ($_.RemoteAddress -and (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue | Where-Object {$_.NameHost -in $domains}))
}

if ($connections) {
    Write-Host "WARNING: Found connections to Larva-24009 infrastructure:" -ForegroundColor Red
    $connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
} else {
    Write-Host "No connections to known Larva-24009 infrastructure found." -ForegroundColor Green
}

# Check for recent LNK files in user profiles
Write-Host "`nChecking for suspicious LNK files in user profiles..." -ForegroundColor Yellow
$userProfiles = Get-ChildItem "C:\Users" -Directory
$suspiciousLNKs = @()

foreach ($profile in $userProfiles) {
    $recentLNKs = Get-ChildItem "$($profile.FullName)\Downloads" -Filter "*.lnk" -Recurse -ErrorAction SilentlyContinue | 
                  Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)}
    if ($recentLNKs) {
        $suspiciousLNKs += $recentLNKs
    }
}

if ($suspiciousLNKs) {
    Write-Host "WARNING: Found recent LNK files that may warrant investigation:" -ForegroundColor Red
    $suspiciousLNKs | Format-Table FullName, LastWriteTime, Length
} else {
    Write-Host "No recent suspicious LNK files found." -ForegroundColor Green
}

# Check for files with known Larva-24009 hashes
Write-Host "`nChecking for files with known Larva-24009 hashes..." -ForegroundColor Yellow
$foundFiles = @()

Get-ChildItem "C:\Users" -Recurse -ErrorAction SilentlyContinue | Where-Object { !$_.PSIsContainer } | ForEach-Object {
    try {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $hashes) {
            $foundFiles += [PSCustomObject]@{
                Path = $_.FullName
                Hash = $hash
                Size = $_.Length
                LastModified = $_.LastWriteTime
            }
        }
    } catch {}
}

if ($foundFiles) {
    Write-Host "CRITICAL: Found files matching known Larva-24009 hashes:" -ForegroundColor Red
    $foundFiles | Format-Table Path, Hash, Size, LastModified
} else {
    Write-Host "No files matching known Larva-24009 hashes found." -ForegroundColor Green
}

# Check for registry keys associated with QuasarRAT persistence
Write-Host "`nChecking for registry persistence mechanisms..." -ForegroundColor Yellow
$quasarRegistryPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

$suspiciousRegistryEntries = @()

foreach ($path in $quasarRegistryPaths) {
    if (Test-Path $path) {
        $entries = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
        foreach ($entry in $entries.PSObject.Properties) {
            if ($entry.Name -ne "PSPath" -and $entry.Name -ne "PSParentPath" -and 
                $entry.Name -ne "PSChildName" -and $entry.Name -ne "PSDrive" -and 
                $entry.Name -ne "PSProvider" -and $entry.Value -match "Quasar|\.exe") {
                $suspiciousRegistryEntries += [PSCustomObject]@{
                    Path = $path
                    Name = $entry.Name
                    Value = $entry.Value
                }
            }
        }
    }
}

if ($suspiciousRegistryEntries) {
    Write-Host "WARNING: Found suspicious registry entries that may be related to Larva-24009:" -ForegroundColor Red
    $suspiciousRegistryEntries | Format-Table Path, Name, Value
} else {
    Write-Host "No suspicious registry entries found." -ForegroundColor Green
}

Write-Host "`nLarva-24009 IOC Hunter completed." -ForegroundColor Cyan

Response Priorities

Immediate (Now)

Block the identified domains (pozeny.shop, aonexa.shop) and IP address (217.77.6.50) at perimeter firewalls and DNS resolvers
Deploy file hash blocklists for all 5 MD5 hashes across EDR solutions
Initiate hunts for suspicious LNK files in user profile directories, especially Downloads folders
Monitor for any network connections to the identified C2 infrastructure
Run the provided PowerShell hunt script on critical systems

24-Hour Actions

Conduct credential audits for accounts with access to sensitive healthcare systems
Review email logs for messages containing LNK attachments with healthcare survey, blockchain, project proposal, or resume themes
Identify and isolate any systems that have communicated with the C2 infrastructure
Perform deep forensic analysis on systems with matching file hashes

1-Week Actions

Implement stricter email filtering for LNK attachments and macro-enabled documents
Enhance user awareness training focused on phishing detection, especially for healthcare-related content
Review and improve PowerShell execution policies and logging across the organization
Consider implementing application allowlisting for healthcare systems
Review segmentation controls to limit lateral movement capabilities

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Larva-24009 (HeptaX) Phishing Campaign: QuasarRAT & UltraVNC Deployment — Healthcare Sector Threat Analysis