Larva-26005 Xctdoor Backdoor, UAT-7810 LapDogs ORB Expansion & Fake CAPTCHA TDS: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Xctdoor Backdoor DLL Side-Loading via LNK Phishing
id: 9f1a2b3c-26005-xctd-0001-a1b2c3d4e5f6
status: experimental
description: Detects Xctdoor/CRAT-family execution pattern where a malicious LNK launches a legitimate signed binary that side-loads a backdoor DLL, associated with Larva-26005 North Korea-nexus campaign
references:
    - https://asec.ahnlab.com/en/94847
author: Security Arsenal Threat Intel
date: 2026/08/06
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk_parent:
        ParentImage|endswith:
            - '\explorer.exe'
        CommandLine|contains:
            - '.lnk'
    selection_suspicious_child:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\msiexec.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate software installers launched from shortcuts
level: high
---
title: Ngrok Tunnel Execution for Backdoor C2
id: 9f1a2b3c-26005-xctd-0002-b2c3d4e5f6a7
status: experimental
description: Detects Ngrok tunnel establishment, used by Xctdoor and CRAT-family malware for resilient TLS-wrapped C2 channels
references:
    - https://asec.ahnlab.com/en/94847
author: Security Arsenal Threat Intel
date: 2026/08/06
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.t1090.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'ngrok.io'
            - 'ngrok-free.app'
            - 'ngrok.app'
    filter_legit_process:
        Image|endswith:
            - '\ngrok.exe'
    condition: selection_domain and not filter_legit_process
falsepositives:
    - Developers using ngrok for legitimate tunneling (rare on servers/endpoints outside dev teams)
level: high
---
title: Suspicious Process Spawned from PDF Reader or CDN-Delivered Fake CAPTCHA Flow
id: 9f1a2b3c-tds-captcha-0003-c3d4e5f6a7b8
status: experimental
description: Detects command shells or script interpreters spawned by PDF readers or browsers after fake CAPTCHA/ClickFix-style paste-to-run execution, delivering Legion Loader or Injuke
references:
    - https://www.netskope.com/blog/fake-captcha-real-business-traffic-distribution-for-hire
author: Security Arsenal Threat Intel
date: 2026/08/06
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1204.002
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\AcroRd32.exe'
            - '\Acrobat.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: all of selection_*
falsepositives:
    - Browser-launched helpdesk scripts (uncommon); tune with command-line allowlists
level: critical

// Hunt for OTX pulse IOCs: Xctdoor/Larva-26005 C2, Fake CAPTCHA TDS domains, and suspicious paste-execution patterns
let MaliciousDomains = dynamic([
    "ntsgo.name",
    "ntsgo-corp.com",
    "casinolegit.info",
    "www.fabioluciani.com",
    "berapt-medii.com",
    "zuwufag.com",
    "binonelola.com",
    "bovetewa.com",
    "dutabuz.com"
]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (MaliciousDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend HitType = "Domain IOC Network Connection";
let DnsHits = DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType == "DnsQueryResponse"
| where AdditionalFields has_any (MaliciousDomains)
| project TimeGenerated, DeviceName, AdditionalFields, InitiatingProcessFileName
| extend HitType = "DNS Query to Malicious Domain";
let PasteExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("msedge.exe", "chrome.exe", "firefox.exe", "AcroRd32.exe", "Acrobat.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HitType = "Browser/PDF Spawned Script Interpreter (Fake CAPTCHA TTP)";
let LnkExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessCommandLine has ".lnk"
| where FileName in~ ("rundll32.exe", "regsvr32.exe", "msiexec.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend HitType = "LNK-Launched LOLBin (Xctdoor TTP)";
union NetworkHits, DnsHits, PasteExec, LnkExec
| order by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (Xctdoor / Fake CAPTCHA TDS / LapDogs artifacts)
# Run elevated on endpoints; outputs findings to console and CSV

$report = @()

# 1. DNS cache check for pulse domain IOCs
$domains = @("ntsgo.name","ntsgo-corp.com","casinolegit.info","www.fabioluciani.com",
             "berapt-medii.com","zuwufag.com","binonelola.com","bovetewa.com","dutabuz.com")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $domains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) {
        $report += [PSCustomObject]@{Category="DNS Cache IOC"; Indicator=$d; Detail=($hit | Out-String); Host=$env:COMPUTERNAME}
    }
}

# 2. Run-key persistence check (Legion Loader / Injuke / CRAT-family pattern)
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $props = Get-ItemProperty $key
        $props.PSObject.Properties | Where-Object {
            $_.Value -match "appdata|temp|public|users\\default" -and $_.Value -match "\.exe|\.dll|rundll32|regsvr32"
        } | ForEach-Object {
            $report += [PSCustomObject]@{Category="Suspicious Run Key"; Indicator=$_.Name; Detail=$_.Value; Host=$env:COMPUTERNAME}
        }
    }
}

# 3. File hash check against known Xctdoor MD5 IOCs in common staging dirs
$iocHashes = @("0d2e61c8a5e6280e065b61e75b848c68","12391f66ee33d379108fd649a999e1a0",
               "01b58f2ff2c14feed46a0768ea46686d","f40c47b9d68ea251957b705c851a6ee9")
$searchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public","$env:USERPROFILE\Downloads")
foreach ($p in $searchPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue -Depth 2 | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($iocHashes -contains $h.ToLower())) {
                $report += [PSCustomObject]@{Category="Malicious File Hash"; Indicator=$h; Detail=$_.FullName; Host=$env:COMPUTERNAME}
            }
        }
    }
}

# 4. Recent LNK files with embedded command lines (Xctdoor phishing TTP)
Get-ChildItem "$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop" -Filter *.lnk -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
    $shell = New-Object -ComObject WScript.Shell
    $sc = $shell.CreateShortcut($_.FullName)
    if ($sc.TargetPath -match "powershell|cmd|rundll32|mshta|wscript" -or $sc.Arguments -match "http|invoke|iex|download") {
        $report += [PSCustomObject]@{Category="Suspicious LNK"; Indicator=$_.Name; Detail="$($sc.TargetPath) $($sc.Arguments)"; Host=$env:COMPUTERNAME}
    }
}

# 5. Active ngrok processes (Xctdoor C2 tunnel)
Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -match "ngrok" } | ForEach-Object {
    $report += [PSCustomObject]@{Category="Ngrok Tunnel Process"; Indicator=$_.ProcessName; Detail=$_.Path; Host=$env:COMPUTERNAME}
}

if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\otx_pulse_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings — escalate to IR." -ForegroundColor Red
} else {
    Write-Host "[+] No IOC matches found on $env:COMPUTERNAME" -ForegroundColor Green
}