LeakNet Ransomware, Hydra Saiga Espionage, and notnullOSX: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential LeakNet ClickFix or Deno Loader Activity
id: 4f8c3b1a-9c0d-4e5f-8a2b-1c3d4e5f6a7b
description: Detects suspicious execution patterns associated with LeakNet campaigns, specifically Deno execution or side-loading of jli.dll.
status: experimental
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_deno:
    Image|endswith:
      - '\deno.exe'
      - '\deno'
  selection_sideload:
    Image|endswith:
      - '\rundll32.exe'
      - '\svchost.exe'
    CommandLine|contains: 'jli.dll'
  condition: 1 of selection_*
falsepositives:
  - Legitimate developer usage of Deno
level: high
---
title: Hydra Saiga Telegram C2 Activity
id: 5a9d4c2b-0d1e-4f6a-8b3c-2d4e5f6a7b8c
description: Detects non-browser processes connecting to Telegram Bot API endpoints, a potential C2 channel used by Hydra Saiga.
status: experimental
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: 'api.telegram.org'
  filter_legit_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\opera.exe'
  condition: selection and not filter_legit_browsers
falsepositives:
  - Legitimate Telegram desktop clients
level: medium
---
title: notnullOSX and ClickFix MacOS Stealer
id: 6b0e5d3c-1e2f-4g7h-9i0j-3e4f5g6h7i8j
description: Detects execution of suspicious DMG mount or unsigned Go binaries associated with notnullOSX activity.
status: experimental
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection_dmg:
    Image|endswith: '/hdiutil'
    CommandLine|contains: 'attach'
  selection_go_binary:
    Image|endswith: '/Contents/MacOS/'
    CommandLine|contains: '/tmp/'
  condition: 1 of selection_*
falsepositives:
  - Legitimate software installation
level: medium

// Hunt for LeakNet and Hydra Saiga Network IOCs
let Domains = dynamic(["okobojirent.com", "mshealthmetrics.com", "serialmenot.com", "neremedysoft.com", "cnoocim.com", "apiclofront.com", "crahdhduf.com", "delhedghogeggs.com", "allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", "wincorpupdates.com", "adm-govuz.com", "coockie.pro"]);
let IP = "83.217.209.88";
DeviceNetworkEvents
| where RemoteUrl in~ (Domains) or RemoteIP == IP
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatActor = iff(RemoteUrl in~ ("okobojirent.com", "mshealthmetrics.com", "serialmenot.com", "neremedysoft.com", "cnoocim.com", "apiclofront.com", "crahdhduf.com", "delhedghogeggs.com"), "LeakNet", iff(RemoteUrl in~ ("allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", "wincorpupdates.com", "adm-govuz.com"), "Hydra Saiga", "notnullOSX"))

# LeakNet and notnullOSX IOC Hunter
# Checks for Deno processes, jli.dll loads, and network connections to suspicious domains

$suspiciousDomains = @(
    "okobojirent.com", "mshealthmetrics.com", "serialmenot.com", "neremedysoft.com", 
    "cnoocim.com", "apiclofront.com", "crahdhduf.com", "delhedghogeggs.com", 
    "allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", "wincorpupdates.com", 
    "adm-govuz.com", "coockie.pro"
)

Write-Host "[*] Checking for Deno processes (LeakNet)..."
$denoProcess = Get-Process -Name "deno" -ErrorAction SilentlyContinue
if ($denoProcess) {
    Write-Host "[!] ALERT: Deno process found! PID: $($denoProcess.Id)" -ForegroundColor Red
} else {
    Write-Host "[-] No Deno process found." -ForegroundColor Green
}

Write-Host "[*] Checking for jli.dll side-loading (LeakNet)..."
$modules = Get-Process | ForEach-Object { $_.Modules } | Where-Object { $_.FileName -like "*jli.dll" }
if ($modules) {
    Write-Host "[!] ALERT: jli.dll loaded in memory by process!" -ForegroundColor Red
    $modules | Select-Object FileName, @{Name="Process";Expression={$_.Process.ProcessName}}
} else {
    Write-Host "[-] No suspicious jli.dll loads detected." -ForegroundColor Green
}

Write-Host "[*] Checking DNS Cache for suspicious domains..."
$dnsCache = Get-DnsClientCache
$foundDomains = @()
foreach ($domain in $suspiciousDomains) {
    $match = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($match) {
        $foundDomains += $domain
    }
}

if ($foundDomains.Count -gt 0) {
    Write-Host "[!] ALERT: Found suspicious domains in DNS Cache:" -ForegroundColor Red
    $foundDomains | ForEach-Object { Write-Host " - $_" }
} else {
    Write-Host "[-] No suspicious domains in DNS cache." -ForegroundColor Green
}

Write-Host "[*] Checking for established connections to 83.217.209.88 (notnullOSX)..."
$netstat = netstat -ano | Select-String "83.217.209.88"
if ($netstat) {
    Write-Host "[!] ALERT: Connection to C2 IP detected:" -ForegroundColor Red
    $netstat
} else {
    Write-Host "[-] No connections to C2 IP found." -ForegroundColor Green
}