The Larva-24009 threat actor (also known as HeptaX) is conducting an active phishing campaign targeting the healthcare sector and global enterprises. This campaign, observed from 2023 through 2026, leverages malicious .lnk files disguised as legitimate documents (e.g., hospital surveys, project proposals) to initiate the attack chain. Upon execution, obfuscated PowerShell commands deploy a malware cocktail including QuasarRAT, UltraVNC, and a notifier component, alongside NirSoft tools for credential theft.

Threat Actor / Malware Profile

Actor: Larva-24009 / HeptaX Malware Families: QuasarRAT, UltraVNC, Notifier, NirSoft Tools

Distribution Method: Phishing emails with attached LNK files. The LNKs use social engineering lures relevant to enterprise operations.
Payload Behavior:
- LNK Execution: Triggers a command prompt leading to obfuscated PowerShell execution.
- QuasarRAT: A .NET Remote Access Trojan (RAT) providing remote control, file management, and command execution capabilities.
- UltraVNC: A legitimate remote administration tool abused for persistent remote access.
- NirSoft Tools: Utilities like WebBrowserPassView or MailPassView likely deployed to harvest saved credentials and browser history.
Persistence: Malware establishes persistence via registry run keys or scheduled tasks (standard for QuasarRAT).
C2 Communication: Connects to known C2 domains (e.g., pozeny.shop) for command and control.
Anti-Analysis: Uses heavy PowerShell obfuscation to hide the malicious intent of the initial script.

IOC Analysis

The provided IOCs include IPv4 addresses, domains, and MD5 file hashes.

Domains/IPs (pozeny.shop, 217.77.6.50): Operationalize by blocking these at the perimeter (firewall/proxy) and alerting on outbound connections in the SIEM. These likely serve as C2 servers for the RAT components.
File Hashes: Specific MD5 hashes for the LNK files and dropped payloads. SOC teams should scan endpoints (EDR) for these hashes to identify compromised hosts.
Tooling: Utilize AlienVault OTX to lookup context. Use SIEM platforms (Splunk, Sentinel) to correlate network events against the C2 infrastructure.

Detection Engineering

YAML

---
title: Suspicious LNK File Spawning PowerShell
id: 9c129d90-ba9a-11ef-9454-0242ac120004
status: experimental
description: Detects when a .lnk file initiates PowerShell, a common technique used by Larva-24009 to deploy malware.
author: Security Arsenal
date: 2026/08/04
references:
    - https://asec.ahnlab.com/en/94786/
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1566.001
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '.lnk'
        Image|endswith:
            - 'powershell.exe'
            - 'pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate system administration shortcuts
level: high
---
title: Potential Credential Theft via NirSoft Tools
id: 1c456f80-ba9a-11ef-a123-0242ac120004
status: experimental
description: Detects the execution of known NirSoft password recovery tools often used by stealers like those deployed by Larva-24009.
author: Security Arsenal
date: 2026/08/04
references:
    - https://asec.ahnlab.com/en/94786/
tags:
    - attack.credential_access
    - attack.t1555
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Company|contains: 'NirSoft'
        OriginalFileName|contains:
            - 'passview'
            - 'pv'
    condition: selection
falsepositives:
    - Authorized administrative credential recovery
level: medium
---
title: Larva-24009 C2 Network Traffic
id: 2e567g90-ba9a-11ef-b456-0242ac120004
status: experimental
description: Detects network connections to known Larva-24009 C2 infrastructure.
author: Security Arsenal
date: 2026/08/04
references:
    - https://otx.alienvault.com/pulse/612345678/
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp:
            - '217.77.6.50'
        DestinationHostname|contains:
            - 'pozeny.shop'
            - 'aonexa.shop'
    condition: selection
falsepositives:
    - Low
level: critical

Microsoft Sentinel (KQL)

KQL — Microsoft Sentinel / Defender

// Hunt for connections to Larva-24009 infrastructure
DeviceNetworkEvents
| where RemoteUrl in ("pozeny.shop", "aonexa.shop") or RemoteIP == "217.77.6.50"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
// Hunt for LNK files launching PowerShell
DeviceProcessEvents
| where InitiatingProcessFileName =~ "explorer.exe" and FileName =~ "powershell.exe"
| where ProcessCommandLine contains ".lnk"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

IOC Hunt Script (PowerShell)

PowerShell

# Hunt for Larva-24009 File Hashes on disk
$TargetHashes = @(
    "10b40185106eb3760cb71c46117aa0bf",
    "1500fefcdda275b70e2051a3e7d9f794",
    "2973fda8d0d0fa0200a05889fce85df6",
    "444fb3592cd1848660259a913684795b",
    "4ad28d0313549e98383144d82982be6e"
)

$DrivesToScan = @("C:\", "D:\")

foreach ($Hash in $TargetHashes) {
    Write-Host "Scanning for hash: $Hash" -ForegroundColor Cyan
    foreach ($Drive in $DrivesToScan) {
        if (Test-Path $Drive) {
            Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
            Where-Object { $_.Length -gt 0 } | 
            ForEach-Object {
                $FileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                if ($FileHash -eq $Hash) {
                    Write-Host "MATCH FOUND: $($_.FullName)" -ForegroundColor Red
                }
            }
        }
    }
}
Write-Host "Scan Complete."


# Response Priorities
**Immediate (0-4h):**
*   Block all listed IOCs (IPs `217.77.6.50`, Domains `pozeny.shop`, `aonexa.shop`) on network perimeter devices.
*   Quarantine any endpoints identified as executing the provided MD5 file hashes.
*   Hunt for `powershell.exe` processes spawned by `.lnk` files.

**24 Hours:**
*   Conduct credential resets for accounts that were active on compromised endpoints during the infection window.
*   Review browser history and stored credentials on infected hosts for signs of theft via NirSoft tools.

**1 Week:**
*   Implement email gateway filtering to block LNK attachments or subject lines matching "hospital survey" or "blockchain proposal" lures.
*   Update user awareness training regarding the specific lure themes used by Larva-24009.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Larva-24009 (HeptaX) Phishing: QuasarRAT & UltraVNC via LNK — OTX Pulse Analysis