Two live OTX pulses published 2026-09-02 expose a dual threat to enterprise identity and endpoint security: a persistent LNK-based phishing operation by the Larva-24009 (HeptaX) actor deploying QuasarRAT and credential-theft tooling against healthcare and Korean/global enterprises, and the emergence of Knight Office, a new Adversary-in-the-Middle phishing kit purpose-built to defeat Microsoft 365 MFA by stealing live session tokens. Together, these pulses describe the current state of identity compromise: endpointRATs for persistence and lateral movement, and AiTM infrastructure that bypasses MFA entirely at the authentication layer.
Threat Summary
These pulses collectively reveal two convergent intrusion strategies targeting enterprise credentials and access:
Pulse 1 — Larva-24009 / HeptaX LNK Campaign (AhnLab ASEC analysis): Active since 2023 and still operating through 2026, Larva-24009 distributes phishing emails themed around hospital surveys, blockchain, project proposals, and resumes. Attachments are Windows shortcut (LNK) files disguised as documents. Execution triggers obfuscated PowerShell that stages multiple payloads: QuasarRAT (open-source remote access trojan), UltraVNC (legitimate remote desktop tool abused for hands-on access), NirSoft utilities (credential extraction), a keylogger, and a 'Notifier' beacon component. Healthcare is a named targeted industry, consistent with the hospital-survey lure themes.
Pulse 2 — Knight Office M365 AiTM Phishing Kit (Huntress analysis): A phishing-as-a-service kit that proxies the real Microsoft 365 login flow, capturing credentials and authenticated session tokens in real time. The lure chain begins with DocuSign-themed emails redirecting through Monday.com links and compromised Joomla sites before landing on credential capture pages. Harvested tokens are fed into the 'Knight Office' console, where operators can replay sessions, register devices, abuse OAuth grants, and even provision Windows Hello for Business to establish durable access — all without triggering MFA.
Collective objective: initial access and credential/session theft at scale. Larva-24009 monetizes endpoint compromise; Knight Office monetizes identity compromise. An organization hit by both has effectively lost control of both the device and the cloud identity planes.
Threat Actor / Malware Profile
Larva-24009 (HeptaX)
- Distribution: Phishing emails with LNK attachments masquerading as hospital surveys, resumes, project proposals, and blockchain documents. Targets Korean and global enterprise users, with healthcare specifically observed.
- Execution chain: LNK → obfuscated PowerShell → payload staging from actor-controlled domains (e.g.,
pozeny.shop,aonexa.shop,mainsec.site). - Payloads:
- QuasarRAT — .NET open-source RAT providing full remote control, keylogging, file transfer, and remote shell. Communicates over TCP with configurable C2; commonly uses TLS-wrapped custom protocol.
- UltraVNC — legitimate remote access binary side-loaded for interactive operator sessions (a living-off-the-land pattern).
- NirSoft tools — browser/email password recovery utilities used for bulk credential theft.
- Notifier — lightweight implant that beacons host state to actor infrastructure.
- Anti-analysis: PowerShell obfuscation (string concatenation, encoding), document-themed decoys, staging from disposable
.shop/.siteTLD infrastructure. - Persistence: QuasarRAT typically installs via Run registry keys and/or scheduled tasks; operators may additionally establish persistence through UltraVNC service installation.
Knight Office AiTM Kit
- Distribution: DocuSign-themed phishing emails → redirect chains through legitimate services (Monday.com) and compromised Joomla websites → AiTM credential capture page.
- Mechanism: Reverse-proxy AiTM. The kit sits between victim and login.microsoftonline.com, relaying the genuine authentication flow and capturing the resulting session cookie/token after MFA completes.
- Post-theft operations (Knight Office console): Session replay, device registration, OAuth consent abuse, and Windows Hello for Business provisioning — converting a stolen session into durable, MFA-independent access.
- Infrastructure: Large pool of lookalike domains, heavily using the
.vuccTLD with concatenated gibberish branding (e.g.,kleepxrnlinecorporation.vu,certififiycationedge.vu). - Anti-analysis: Redirect laundering through legitimate SaaS (Monday.com) defeats URL reputation; compromised Joomla sites add sender-infrastructure diversity.
IOC Analysis
The pulses contain two indicator classes requiring different operational handling:
FileHash-MD5 (Larva-24009): e.g., 10b40185106eb3760cb71c46117aa0bf, 1500fefcdda275b70e2051a3e7d9f794, 2973fda8d0d0fa0200a05889fce85df6, 444fb3592cd1848660259a913684795b, 4ad28d0313549e98383144d82982be6e. MD5 hashes are brittle — a single byte change defeats them — so use them for retro-hunting in EDR/AV telemetry and email attachment detonation records, not as your primary detection. Pivot to behavior (LNK spawning PowerShell) for durable coverage.
Domains:
- Larva-24009 staging:
pozeny.shop,aonexa.shop,mainsec.site— block at DNS/proxy; alert on any historical resolution. - Knight Office:
.vulookalike domains (kleepxrnlinecorporation.vu,advancedplacyncement.vu,amstardmzsmc.vu,arandasoftzfdware.vu,avisoretentiunionllc.vu,capitalflwxinancialpartners.vu,certififiycationedge.vu,connectivnqzityltd.vu, plus 18 more in the pulse). Block the full list; consider alerting on all.vulookups from corporate endpoints as a high-signal, low-noise analytic given the rarity of legitimate business use.
Operationalization: Ingest into your TI platform (MISP/OpenCTI) with TLP:WHITE handling, push domains to DNS sinkhole/proxy blocklists and EDR network IOC feeds, push hashes to EDR block lists, and run retro-hunts across 30–90 days of DNS and proxy logs. URLScan.io and VirusTotal will decode the redirect chains; use urlscan submissions of the Monday.com/Joomla redirect URLs to surface live Knight Office landing pages.
Detection Engineering
---
title: Larva-24009 LNK Execution Spawning Obfuscated PowerShell
id: 7f3a1c2e-9b4d-4e1a-a5f2-2026090201
status: experimental
description: Detects LNK shortcut files launching PowerShell with obfuscation flags, consistent with Larva-24009/HeptaX phishing chain delivering QuasarRAT, UltraVNC, and NirSoft credential theft tools.
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\explorer.exe'
- '\outlook.exe'
- '\winword.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
selection_flags:
CommandLine|contains:
- '-enc'
- '-encodedcommand'
- '-w hidden'
- '-windowstyle hidden'
- 'iex'
- 'downloadstring'
- 'frombase64string'
selection_lnk:
CommandLine|contains: '.lnk'
condition: selection_child and (selection_parent or selection_lnk) and 1 of selection_flags
falsepositives:
- Rare; legitimate admin scripts may use encoded commands but not launched from LNK files or mail clients
level: high
tags:
- attack.execution
- attack.t1059.001
- attack.t1204.002
date: 2026/09/02
---
title: QuasarRAT / UltraVNC Persistence via Run Key or Service Install
id: 7f3a1c2e-9b4d-4e1a-a5f2-2026090202
status: experimental
description: Detects registry Run key or service-based persistence for QuasarRAT and abused UltraVNC binaries installed by the Larva-24009 campaign.
author: Security Arsenal
logsource:
category: registry_set
product: windows
detection:
selection_key:
TargetObject|contains:
- '\CurrentVersion\Run'
- '\CurrentVersion\RunOnce'
- '\Services\uvnc'
selection_value:
Details|contains:
- '\AppData\Roaming\'
- '\AppData\Local\Temp\'
- 'uvnc'
- 'winvnc'
- 'quasar'
- 'notifier'
condition: selection_key and selection_value
falsepositives:
- Legitimate UltraVNC enterprise deployments; baseline known-good VNC paths before enforcement
level: high
tags:
- attack.persistence
- attack.t1060
- attack.t1547.001
date: 2026/09/02
---
title: Knight Office AiTM Phishing Infrastructure DNS Lookup
id: 7f3a1c2e-9b4d-4e1a-a5f2-2026090203
status: experimental
description: Detects DNS resolution of known Knight Office AiTM phishing domains and suspicious .vu ccTLD lookalike domains used for M365 session token theft.
author: Security Arsenal
logsource:
category: dns
product: windows
detection:
selection_iocs:
query|contains:
- 'kleepxrnlinecorporation.vu'
- 'advancedplacyncement.vu'
- 'amstardmzsmc.vu'
- 'arandasoftzfdware.vu'
- 'avisoretentiunionllc.vu'
- 'capitalflwxinancialpartners.vu'
- 'certififiycationedge.vu'
- 'connectivnqzityltd.vu'
- 'pozeny.shop'
- 'aonexa.shop'
- 'mainsec.site'
condition: selection_iocs
falsepositives:
- None expected; these are actor-controlled domains
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
- attack.t1557
date: 2026/09/02
// Hunt: Larva-24009 LNK->PowerShell chain, QuasarRAT staging domains, and Knight Office AiTM infrastructure
let badDomains = dynamic(["pozeny.shop","aonexa.shop","mainsec.site","kleepxrnlinecorporation.vu","advancedplacyncement.vu","amstardmzsmc.vu","arandasoftzfdware.vu","avisoretentiunionllc.vu","capitalflwxinancialpartners.vu","certififiycationedge.vu","connectivnqzityltd.vu"]);
let lnkPS = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any (".lnk","-enc","encodedcommand","frombase64string","downloadstring")
and InitiatingProcessFileName in~ ("explorer.exe","outlook.exe","msedge.exe","chrome.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256=SHA256
| extend Hunt = "LNK_PowerShell_Chain";
let netHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (badDomains) or RemoteUrl endswith ".vu"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| extend Hunt = "Malicious_Domain_Connection";
let hashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where MD5 in ("10b40185106eb3760cb71c46117aa0bf","1500fefcdda275b70e2051a3e7d9f794","2973fda8d0d0fa0200a05889fce85df6","444fb3592cd1848660259a913684795b","4ad28d0313549e98383144d82982be6e")
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, InitiatingProcessFileName
| extend Hunt = "Known_Bad_Hash";
union lnkPS, netHits, hashHits
| sort by TimeGenerated desc
# IOC Hunt Script: Larva-24009 QuasarRAT persistence + Knight Office artifacts
# Run elevated on suspected endpoints or deploy via RMM/Intune remediation
$results = @()
# 1. Check Run/RunOnce persistence keys for suspicious AppData payloads
$runKeys = @(
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
if (Test-Path $key) {
Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
$val = (Get-ItemProperty $key).($_.Name)
if ($val -match 'AppData|Temp|quasar|uvnc|winvnc|notifier') {
$results += [PSCustomObject]@{Check='RunKey'; Path=$key; Name=$_.Name; Value=$val}
}
}
}
}
# 2. Scheduled tasks executing from user-writable paths
Get-ScheduledTask | ForEach-Object {
$actions = $_.Actions.Execute
if ($actions -match 'AppData|Temp|quasar|uvnc|notifier') {
$results += [PSCustomObject]@{Check='ScheduledTask'; Path=$_.TaskName; Name=''; Value=$actions}
}
}
# 3. UltraVNC service installation (abused by Larva-24009)
Get-Service | Where-Object { $_.Name -match 'uvnc|winvnc' } | ForEach-Object {
$results += [PSCustomObject]@{Check='VNCService'; Path=$_.Name; Name=$_.Status; Value=$_.DisplayName}
}
# 4. Active/historical connections to known C2 & AiTM domains (DNS cache + netstat)
$badDomains = @('pozeny.shop','aonexa.shop','mainsec.site')
$dnsCache = Get-DnsClientCache | Where-Object { $badDomains -contains $_.Entry -or $_.Entry -like '*.vu' }
foreach ($d in $dnsCache) {
$results += [PSCustomObject]@{Check='DNSCache'; Path=$d.Entry; Name=$d.Type; Value=$d.Data}
}
# 5. Known malicious file hashes on disk (common staging paths)
$badHashes = @('10b40185106eb3760cb71c46117aa0bf','1500fefcdda275b70e2051a3e7d9f794','2973fda8d0d0fa0200a05889fce85df6','444fb3592cd1848660259a913684795b','4ad28d0313549e98383144d82982be6e')
$searchPaths = @("$env:USERPROFILE\Downloads","$env:TEMP","$env:APPDATA")
foreach ($p in $searchPaths) {
Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
if ($badHashes -contains $h.ToLower()) {
$results += [PSCustomObject]@{Check='BadHash'; Path=$_.FullName; Name=$h; Value='MATCH'}
}
}
}
if ($results.Count -gt 0) {
Write-Host "[ALERT] $($results.Count) suspicious artifacts found:" -ForegroundColor Red
$results | Format-Table -AutoSize
$results | Export-Csv "$env:TEMP\larva24009_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
} else {
Write-Host "[CLEAN] No Larva-24009 / Knight Office artifacts detected." -ForegroundColor Green
}
Response Priorities
Immediate (0–4 hours):
- Block all pulse domains at DNS, proxy, and EDR network layers — including the Larva-24009 staging domains and all
.vuKnight Office indicators; alert on any.vuresolution as high-fidelity. - Push the five MD5 hashes to EDR/AV block lists and email gateway attachment filters; retro-hunt 90 days of attachment and download telemetry.
- Hunt for LNK → PowerShell execution using the Sigma and KQL analytics above; quarantine any endpoint with hits.
- Block inbound email attachments of type
.lnkat the gateway — there is no legitimate business case for emailed shortcuts.
24 Hours:
- Identity verification is mandatory — both pulses involve credential/session theft. For any user who may have interacted with DocuSign-themed lures or the listed domains: revoke all Entra ID refresh tokens and active sessions, force password reset, and re-register MFA.
- Audit Entra ID for anomalous device registrations, new OAuth consent grants, and unexpected Windows Hello for Business enrollments — the Knight Office console's persistence playbook. Review sign-in logs for token-replay indicators (session continuity from impossible-travel IPs or unfamiliar ASNs).
- For Larva-24009 exposure: rotate all credentials stored in browsers/mail clients on affected hosts (NirSoft tooling means they should be assumed compromised), and check for unauthorized UltraVNC services indicating interactive operator access.
1 Week:
- Architecture hardening against AiTM: deploy phishing-resistant MFA (FIDO2/passkeys or certificate-based auth) for all users, prioritizing healthcare and privileged accounts; enable Entra ID Conditional Access token protection / compliant-device requirements so stolen session cookies cannot be replayed from unmanaged devices.
- Restrict OAuth consent to admin-approved applications and alert on new device registrations.
- Constrain PowerShell via Constrained Language Mode and script-block logging; disable LNK execution from user-writable locations via ASR rules.
- Add hospital-survey / DocuSign-themed lure simulations to phishing training, reflecting the exact lures observed in these campaigns.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.