Lazarus FaceStealer $400M Crypto Heist + ESXi Hypervisor Ransomware + ClickFix NetSupport RAT: OTX Pulse Intelligence & Enterprise Detection Pack

---
title: ClickFix Clipboard PowerShell Execution with Decimal-Encoded IP
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a01
status: production
description: Detects PowerShell spawned from Run dialog / explorer context reaching decimal-encoded (integer-format) IP addresses, consistent with ClickFix NetSupport RAT delivery via fake verification pages.
author: Security Arsenal Threat Intelligence
references:
  - https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe'  # Run dialog launches via svchost in some paths
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|re: '(invoke-webrequest|iwr|curl|invoke-restmethod|irm|downloadstring).*([0-9]{8,10})(/|\s|$)'
  condition: selection_img and selection_cmd
falsepositives:
  - Rare; legitimate tooling virtually never uses decimal-encoded IP literals
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
---
title: NetSupport RAT Installation and Execution Artifacts
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a02
status: production
description: Detects NetSupport RAT client (client32.exe) execution from non-standard paths or with suspicious parentage, indicative of trojanized deployment rather than managed RMM rollout.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith: '\client32.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\NetSupport\'
      - 'C:\Program Files (x86)\NetSupport\'
  condition: selection_binary and not filter_approved_paths
falsepositives:
  - MSP environments deploying NetSupport from custom paths; baseline approved RMM deployment locations
level: high
tags:
  - attack.command_and_control
  - attack.t1219
---
title: vCenter or ESXi Management Interface Anomalous Session Activity
id: 9f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a03
status: production
description: Detects suspicious child processes or tool execution on vCenter Server Appliance / ESXi hosts, including MeshAgent and Ligolo-ng artifacts observed in ESXi ransomware intrusions such as BlackNevas.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/esxi-ransomware/121959/
logsource:
  category: process_creation
  product: linux
detection:
  selection_tooling:
    Image|endswith:
      - '/meshagent'
      - '/ligolo-ng'
      - '/ligolo'
      - '/chisel'
  selection_suspicious_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
    ParentImage|contains:
      - 'hostd'
      - 'vpxd'
      - 'vmware'
  condition: 1 of selection_*
falsepositives:
  - VMware admin maintenance shells; correlate against change windows and bastion-source IPs
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1572
  - attack.impact
  - attack.t1490

// Hunt: ClickFix staging, NetSupport RAT, FaceStealer lures, ESXi tooling - Security Arsenal OTX 2026-11-13
let Lookback = 30d;
let BadDomains = dynamic(["uu01webzoom.us", "apartments-review8509831.sbs", "verify.apartments-review.sbs", "asgomd.com", "asgrsv.com"]);
let BadIPs = dynamic(["89.34.90.203", "188.240.57.94", "91.92.242.121"]);
// 1. Direct IOC network hits
let IocHits = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl in~ (BadDomains) or RemoteIP in~ (BadIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend HuntType = "Direct IOC";
// 2. Decimal-encoded IP in PowerShell command lines (ClickFix behavior)
let DecimalIp = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(iwr|irm|invoke-webrequest|invoke-restmethod|downloadstring|curl)[^\r\n]*\b[0-9]{8,10}\b"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend HuntType = "ClickFix Decimal-IP PowerShell";
// 3. NetSupport RAT unsanctioned execution
let NetSupport = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName =~ "client32.exe"
| where FolderPath !startswith "C:\\Program Files\\NetSupport" and FolderPath !startswith "C:\\Program Files (x86)\\NetSupport"
| project TimeGenerated, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| extend HuntType = "NetSupport RAT Non-Standard Path";
// 4. Run-dialog-launched scripting (Win+R -> Ctrl+V -> Enter pattern)
let RunDialog = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("http", "iwr", "downloadstring", "encodedcommand", "-enc ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
| extend HuntType = "Run Dialog Script Launcher";
// 5. ESXi/pivot tooling on endpoints
let PivotTools = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName has_any ("meshagent", "ligolo", "chisel") or ProcessCommandLine has_any ("ligolo", "meshagent")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
| extend HuntType = "ESXi Intrusion Tooling";
union IocHits, DecimalIp, NetSupport, RunDialog, PivotTools
| order by TimeGenerated desc

# Security Arsenal - OTX 2026-11-13 IOC Hunt Script
# Hunts: NetSupport RAT artifacts, ClickFix remnants, FaceStealer lure references, ESXi tooling
# Run elevated on Windows endpoints; review output before taking action.

$Report = @()
$BadDomains = @('uu01webzoom.us','apartments-review8509831.sbs','verify.apartments-review.sbs','asgomd.com','asgrsv.com')
$BadIPs     = @('89.34.90.203','188.240.57.94','91.92.242.121')

Write-Host "[*] 1/6 Checking for NetSupport RAT installations (non-standard paths)..." -ForegroundColor Cyan
$paths = @("$env:ProgramFiles","${env:ProgramFiles(x86)}",$env:ProgramData,$env:LOCALAPPDATA,$env:APPDATA)
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -Filter 'client32.exe' -ErrorAction SilentlyContinue | ForEach-Object {
        $Report += [pscustomobject]@{Check='NetSupport Binary'; Finding=$_.FullName; Detail="Size: $($_.Length) bytes"}
    }
}
Get-ChildItem 'HKLM:\SOFTWARE','HKCU:\SOFTWARE' -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'NetSupport' } | ForEach-Object {
        $Report += [pscustomobject]@{Check='NetSupport Registry'; Finding=$_.Name; Detail=''}
    }

Write-Host "[*] 2/6 Checking active and recent network connections to malicious IPs..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $BadIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $Report += [pscustomobject]@{Check='Malicious Connection'; Finding="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort)"; Detail="State=$($_.State) Process=$proc (PID $($_.OwningProcess))"}
}

Write-Host "[*] 3/6 Checking DNS cache for malicious domains..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n=$_.Name; ($BadDomains | Where-Object { $n -like "*$_*" }) } | ForEach-Object {
    $Report += [pscustomobject]@{Check='DNS Cache Hit'; Finding=$_.Name; Detail=$_.Data}
}

Write-Host "[*] 4/6 Checking RunMRU for ClickFix paste-execution artifacts..." -ForegroundColor Cyan
$mru = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue
if ($mru) {
    $mru.PSObject.Properties | Where-Object { $_.Value -match 'powershell|iwr|invoke|downloadstring|\d{8,10}' } | ForEach-Object {
        $Report += [pscustomobject]@{Check='RunMRU Suspicious'; Finding=$_.Name; Detail=($_.Value -replace '\x00.*$','')}
    }
}

Write-Host "[*] 5/6 Checking scheduled tasks and Run keys for persistence..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match 'powershell|client32|meshagent' -and $_.Actions.Arguments -match 'http|enc|hidden|\d{8,10}' } | ForEach-Object {
    $Report += [pscustomobject]@{Check='Scheduled Task'; Finding=$_.TaskName; Detail="$($_.Actions.Execute) $($_.Actions.Arguments)"}
}
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
    Get-ItemProperty $_ -ErrorAction SilentlyContinue | ForEach-Object { $_.PSObject.Properties } |
        Where-Object { $_.Value -match 'powershell|client32|AppData|Temp' } | ForEach-Object {
            $Report += [pscustomobject]@{Check='Run Key'; Finding=$_.Name; Detail=$_.Value}
        }
}

Write-Host "[*] 6/6 Checking for ESXi-intrusion tooling (MeshAgent/Ligolo-ng)..." -ForegroundColor Cyan
Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -match 'meshagent|ligolo|chisel' } | ForEach-Object {
    $Report += [pscustomobject]@{Check='Pivot Tool Process'; Finding=$_.ProcessName; Detail="PID $($_.Id) Path: $($_.Path)"}
}
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'mesh|netsupport' } | ForEach-Object {
    $Report += [pscustomobject]@{Check='Suspicious Service'; Finding=$_.Name; Detail=$_.Status}
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($Report.Count -eq 0) { Write-Host "No indicators found on $env:COMPUTERNAME" -ForegroundColor Green }
else { $Report | Format-Table -AutoSize | Out-String -Width 300 | Write-Host }
$Report | Export-Csv -Path ".\otx_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "Report saved to .\otx_hunt_$env:COMPUTERNAME.csv" -ForegroundColor Cyan