MadApe Device Code Phishing Kit + Zimbra CVE-2026-73570 & NetScaler CVE-2026-88771 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack

---
title: MadApe Microsoft Device Code Phishing - Suspicious Device Code Flow Initiation
id: 9e2a4f8c-1b7d-4e3a-9f5c-3d8a2c6e1b4f
status: experimental
description: Detects OAuth 2.0 Device Authorization Grant flow initiation from non-managed devices or unusual locations, characteristic of MadApe phishing kit activity.
author: Security Arsenal Threat Intel
references:
  - https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/
date: 2026/10/31
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    - authenticationProtocol: 'deviceCode'
    - deviceDetail.browser: 'Unknown'
  condition: selection
  timeframe: 1h
falsepositives:
  - Legitimate device code flow for CLI tools (Azure CLI, VS Code)
level: high
tags:
  - attack.t1528
  - attack.t1078.004
---
title: Zimbra CVE-2026-73570 - JSP WebShell Creation in Webapps Directory
id: 7f3b1e9a-4c2d-4a8e-b1c5-9d7e2f4a6c8b
status: experimental
description: Detects creation of JSP files in Zimbra webapps directory, consistent with China Chopper / Godzilla webshell deployment following CVE-2026-73570 exploitation.
author: Security Arsenal Threat Intel
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/
date: 2026/10/31
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '/opt/zimbra/jetty/webapps/zimbra/'
      - '/opt/zimbra/jetty/webapps/zimbraAdmin/'
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
  condition: selection
falsepositives:
  - Zimbra updates or legitimate plugin installation
level: critical
tags:
  - attack.t1190
  - attack.t1505.003
  - cve.2026-73570
---
title: Citrix NetScaler CVE-2026-88771 - Suspicious Perl Reverse Shell Execution
id: 2c8d4e6f-9a1b-4c3d-8e5f-7a9b1c3d5e7f
status: experimental
description: Detects execution of Perl scripts with suspicious naming patterns (update_c*.pl) or network connections to known NetScaler exploitation C2.
author: Security Arsenal Threat Intel
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators
date: 2026/10/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\perl.exe'
      - '\perl5*'
  selection_cmdline:
    CommandLine|contains:
      - 'update_c'
      - '.pl '
      - 'socket'
      - '64.94.85.67'
  condition: selection_image and selection_cmdline
falsepositives:
  - Legitimate Perl automation scripts
level: critical
tags:
  - attack.t1190
  - attack.t1059.001
  - attack.t1071.001
  - cve.2026-88771
---
title: Trojanized Claude Code Extension - SSH Key Persistence
id: 5a7b9c1d-3e5f-4a7b-9c2d-4e6f8a1b3c5d
status: experimental
description: Detects modification of SSH authorized_keys file or creation of reverse SSH tunnels, consistent with the trojanized Claude Code extension backdoor.
author: Security Arsenal Threat Intel
references:
  - https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
date: 2026/10/31
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.ssh\authorized_keys'
      - '\.ssh\authorized_keys2'
  filter_legitimate:
    Image|contains:
      - '\Windows\System32\'
      - '\OpenSSH\'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate SSH key deployment via GPO or configuration management
level: high
tags:
  - attack.t1133
  - attack.t1098.004
  - attack.t1572

// KQL Hunt: MadApe Device Code Phishing + Zimbra/NetScaler Exploitation IOCs
// Microsoft Sentinel | 90-day lookback recommended
let lookback = 90d;
let madape_domains = dynamic(["sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com"]);
let zimbra_c2 = dynamic(["psk1zim.abrdns.com","tls.psk1zim.abrdns.com"]);
let ai_relays = dynamic(["vibe.aiok.me","aiok.me","sorryios.io","nuoda.vip","chat.nuoda.vip","mirbuds.com"]);
let netscaler_c2 = "64.94.85.67";
let sha256_hashes = dynamic([
    "18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927",
    "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
    "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15",
    "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c",
    "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938",
    "dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a",
    "aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d",
    "6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244",
    "bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf",
    "b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159"
]);
// Hunt 1: Device Code authentication events (MadApe)
union isfuzzy=true
    (SigninLogs
    | where TimeGenerated >= ago(lookback)
    | where AuthenticationProtocol == "deviceCode" or (AuthenticationDetails has "device code")
    | project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, DeviceDetail, Location, Status, AuthenticationProtocol
    | extend Hunt = "MadApe DeviceCode"),
// Hunt 2: Network connections to phishing/C2 domains
    (DeviceNetworkEvents
    | where TimeGenerated >= ago(lookback)
    | where RemoteUrl has_any (madape_domains) or RemoteUrl has_any (zimbra_c2) or RemoteUrl has_any (ai_relays) or RemoteIP == netscaler_c2
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
    | extend Hunt = "C2/Phishing Domain"),
// Hunt 3: File hash matches on endpoints
    (DeviceFileEvents
    | where TimeGenerated >= ago(lookback)
    | where SHA256 in~ (sha256_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
    | extend Hunt = "Malicious File Hash"),
// Hunt 4: Process creation for NetScaler Perl payload or SSH backdoor
    (DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where (FileName =~ "perl.exe" and ProcessCommandLine has_any ("update_c", ".pl")) or
            (FileName =~ "ssh.exe" and ProcessCommandLine has_any ("-R", "svc-telemetry"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName
    | extend Hunt = "Suspicious Process")
| order by TimeGenerated desc

# PowerShell IOC Hunt Script - MadApe, Zimbra, NetScaler, Claude Extension Backdoor
# Run as Administrator on endpoints; outputs CSV to $env:TEMP\OTX_Hunt_Results.csv
# Requires: PowerShell 5.1+; no external modules

$ErrorActionPreference = 'SilentlyContinue'
$results = @()
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

# --- 1. Check for malicious SHA256 hashes on disk ---
$malHashes = @(
    "18756b75afedee74bbf49832a1b1dada4961672c41d595be5c1bbe75709de927",
    "7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278",
    "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15",
    "e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c",
    "974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938",
    "dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a",
    "aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d",
    "6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244",
    "bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf",
    "b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159"
)

Write-Host "[+] Scanning common payload drop paths for malicious hashes..."
$scanPaths = @($env:TEMP, $env:APPDATA, $env:LOCALAPPDATA, "C:\ProgramData", "C:\Users\Public\Downloads")
foreach ($path in $scanPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($malHashes -contains $hash) {
            $results += [PSCustomObject]@{
                Timestamp = $timestamp
                HuntType = "Malicious File Hash"
                Host = $env:COMPUTERNAME
                Indicator = $hash
                Path = $_.FullName
                Details = "Matched OTX pulse IOC"
            }
        }
    }
}

# --- 2. Check SSH authorized_keys for 'svc-telemetry' backdoor ---
Write-Host "[+] Checking SSH authorized_keys for suspicious keys..."
$userDirs = Get-ChildItem "C:\Users" -Directory
foreach ($user in $userDirs) {
    $authKeys = Join-Path $user.FullName ".ssh\authorized_keys"
    if (Test-Path $authKeys) {
        $content = Get-Content $authKeys -Raw
        if ($content -match "svc-telemetry") {
            $results += [PSCustomObject]@{
                Timestamp = $timestamp
                HuntType = "SSH Backdoor Key"
                Host = $env:COMPUTERNAME
                Indicator = "svc-telemetry"
                Path = $authKeys
                Details = "Trojanized Claude Code extension persistence"
            }
        }
    }
}

# --- 3. Check for suspicious SSH reverse tunnels ---
Write-Host "[+] Checking for active SSH reverse tunnels..."
$sshConns = Get-NetTCPConnection | Where-Object { $_.OwningProcess -ne 0 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc.ProcessName -match "ssh" -and $_.RemotePort -eq 22 -and $_.State -eq "Established") {
        $cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($_.OwningProcess)").CommandLine
        if ($cmdLine -match "-R") {
            $results += [PSCustomObject]@{
                Timestamp = $timestamp
                HuntType = "SSH Reverse Tunnel"
                Host = $env:COMPUTERNAME
                Indicator = $cmdLine
                Path = $proc.Path
                Details = "Potential exfiltration or C2 tunnel"
            }
        }
    }
}

# --- 4. Check for NetScaler Perl payload artifacts ---
Write-Host "[+] Checking for Perl reverse-shell artifacts..."
$perlProcs = Get-CimInstance Win32_Process -Filter "Name like '%perl%'"
foreach ($proc in $perlProcs) {
    if ($proc.CommandLine -match "update_c" -or $proc.CommandLine -match "\.pl") {
        $results += [PSCustomObject]@{
            Timestamp = $timestamp
            HuntType = "Suspicious Perl Process"
            Host = $env:COMPUTERNAME
            Indicator = $proc.CommandLine
            Path = $proc.ExecutablePath
            Details = "Possible NetScaler CVE-2026-88771 payload"
        }
    }
}

# --- 5. Check DNS cache for MadApe / AI relay domains ---
Write-Host "[+] Checking DNS cache for malicious domains..."
$badDomains = @("sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com","aiok.me","nuoda.vip","mirbuds.com","psk1zim.abrdns.com")
$dnsCache = Get-DnsClientCache
foreach ($entry in $dnsCache) {
    foreach ($domain in $badDomains) {
        if ($entry.Name -like "*$domain*") {
            $results += [PSCustomObject]@{
                Timestamp = $timestamp
                HuntType = "Malicious DNS Resolution"
                Host = $env:COMPUTERNAME
                Indicator = $entry.Name
                Path = $entry.IPAddress
                Details = "Matched OTX phishing/C2 domain"
            }
        }
    }
}

# --- 6. Check for suspicious OAuth consent (MadApe) via registry/MSGraph note ---
# Note: Full OAuth consent hunting requires MS Graph; this checks for suspicious device code auth in event logs
Write-Host "[+] Checking Windows Event Logs for Device Code auth events..."
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-7)} | Where-Object {
    $_.Message -match "device code" -or $_.Message -match "deviceCode"
}
foreach ($event in $events) {
    $results += [PSCustomObject]@{
        Timestamp = $event.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss")
        HuntType = "Device Code Auth Event"
        Host = $env:COMPUTERNAME
        Indicator = "EventID 4624"
        Path = $event.Message.Substring(0, [Math]::Min(200, $event.Message.Length))
        Details = "Review for MadApe phishing kit activity"
    }
}

# --- Output ---
if ($results.Count -gt 0) {
    $outputPath = "$env:TEMP\OTX_Hunt_Results_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $results | Export-Csv -Path $outputPath -NoTypeInformation
    Write-Host "[!] $($results.Count) suspicious indicators found. Results saved to: $outputPath"
    $results | Format-Table -AutoSize
} else {
    Write-Host "[+] No indicators of compromise found."
}

Write-Host "[i] Hunt complete. Review findings and correlate with SIEM/EDR telemetry."