Mantax Otax Mobile Ransomware, CAV3RN Espionage Framework & Browser Extension Crypto Theft: OTX Pulse Detection Pack

---
title: Project CAV3RN Espionage Framework DLL Execution
id: 3f8a2c1e-7b4d-4e9f-a1c2-cav3rn000001
status: experimental
description: Detects loading or execution of Project CAV3RN modular DLL components (GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, texture.dll) masquerading as legitimate Google/system components, per OTX pulse on CAV3RN targeting Israel.
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/project-cav3rn-continues/120991
date: 2026/09/10
logsource:
    category: image_load
    product: windows
detection:
    selection_dll_names:
        ImageLoaded|endswith:
            - '\GoogleService.dll'
            - '\CommunicationUxTheme.dll'
            - '\rnp.dll'
            - '\texture.dll'
    filter_legit_paths:
        ImageLoaded|startswith:
            - 'C:\Program Files\Google\'
            - 'C:\Program Files (x86)\Google\'
    condition: selection_dll_names and not filter_legit_paths
falsepositives:
    - Legitimate Google software loading GoogleService.dll from its install directory
level: high
tags:
    - attack.defense_evasion
    - attack.t1573
    - attack.t1071.001
---
title: DNS-Based C2 Channel Negotiation - CAV3RN Infrastructure
id: 3f8a2c1e-7b4d-4e9f-a1c2-cav3rn000002
status: experimental
description: Detects DNS queries to known Project CAV3RN C2 and nameserver infrastructure, plus suspicious non-browser processes resolving Google Apps Script endpoints consistent with CAV3RN's Apps Script relay channel.
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/project-cav3rn-continues/120991
date: 2026/09/10
logsource:
    category: dns
    product: windows
detection:
    selection_c2:
        query|contains:
            - 'studiotikva.com'
            - 'bonto.run'
            - 'j7tracker.io'
    condition: selection_c2
falsepositives:
    - Threat hunting or sandbox detonation of these indicators
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.004
    - attack.t1102
---
title: Suspicious Process Outbound Connection to Google Apps Script Relay
id: 3f8a2c1e-7b4d-4e9f-a1c2-cav3rn000003
status: experimental
description: Detects non-browser, non-Google processes initiating HTTPS connections to Google Apps Script (script.google.com / script.googleusercontent.com), a known CAV3RN C2 relay technique that abuses trusted Google infrastructure to bypass egress filtering.
author: Security Arsenal Threat Intelligence
references:
    - https://securelist.com/project-cav3rn-continues/120991
date: 2026/09/10
logsource:
    category: network_connection
    product: windows
detection:
    selection_dest:
        DestinationHostname|contains:
            - 'script.google.com'
            - 'script.googleusercontent.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\iexplore.exe'
            - '\GoogleUpdate.exe'
    condition: selection_dest and not filter_browsers
falsepositives:
    - Automation tooling or RMM platforms legitimately invoking Apps Script webhooks
level: medium
tags:
    - attack.command_and_control
    - attack.t1102.002
    - attack.t1071.001

// Unified hunt: CAV3RN C2 infrastructure, extension-cluster exfil domains,
// and suspicious non-browser Apps Script connections
let C2Domains = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com", "j7tracker.io", "bonto.run", "cloudflare.bonto.run", "susi.bonto.run"]);
let ScriptRelay = dynamic(["script.google.com", "script.googleusercontent.com"]);
let BrowserProcs = dynamic(["chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "GoogleUpdate.exe", "msedgewebview2.exe"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (C2Domains)
| project TimeGenerated, DeviceName, InitiatingProcessName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType, Hit="KnownC2"),
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (ScriptRelay)
| where not(InitiatingProcessFileName in~ (BrowserProcs))
| project TimeGenerated, DeviceName, InitiatingProcessName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType, Hit="AppsScriptRelay-Anomaly"),
(DeviceImageLoadEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("GoogleService.dll", "CommunicationUxTheme.dll", "rnp.dll", "texture.dll", "net.dll")
| where not(FolderPath has_any ("Program Files\\Google", "Program Files (x86)\\Google", "Windows\\WinSxS", "Windows\\System32"))
| project TimeGenerated, DeviceName, InitiatingProcessName, FileName, FolderPath, SHA256, Hit="CAV3RN-DLL-Load")
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (2026-09-10)
# Hunts: CAV3RN DLLs, malicious browser extensions, C2 connections, Mantax Otax hashes on attached Android devices
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. CAV3RN module DLLs in suspicious paths ---
$cav3rnDlls = @('GoogleService.dll','CommunicationUxTheme.dll','rnp.dll','texture.dll')
$searchRoots = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","C:\Users\Public")
foreach ($root in $searchRoots) {
    foreach ($dll in $cav3rnDlls) {
        Get-ChildItem -Path $root -Recurse -Filter $dll -Depth 4 | ForEach-Object {
            $report += [PSCustomObject]@{Check='CAV3RN-DLL'; Finding=$_.FullName; Risk='HIGH'}
        }
    }
}

# --- 2. CAV3RN / extension-cluster file hashes ---
$iocHashes = @(
    '83df0b5583e5f5a282bc0987e220166f0367288b069146ae7d44f4a2d4b21d22',
    '5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91',
    '904784c9943d019da332bea2cd03996f',
    'f9156d42410c8a5429dec43329bd72e0'
)
foreach ($root in $searchRoots) {
    Get-ChildItem -Path $root -Recurse -File -Depth 3 | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        if ($iocHashes -contains $h) {
            $report += [PSCustomObject]@{Check='IOC-Hash'; Finding="$($_.FullName) [$h]"; Risk='CRITICAL'}
        }
    }
}

# --- 3. Malicious crypto-stealing browser extensions ---
$badExtNames = @('J7Tracker','VREO','Orbit Tracker','GhostApe')
$chromeExtRoot = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$ffProfiles = "$env:APPDATA\Mozilla\Firefox\Profiles"
Get-ChildItem $chromeExtRoot -Recurse -Filter 'manifest.json' -Depth 5 | ForEach-Object {
    $m = Get-Content $_.FullName -Raw | ConvertFrom-Json
    foreach ($bad in $badExtNames) {
        if ($m.name -like "*$bad*") {
            $report += [PSCustomObject]@{Check='Malicious-Extension'; Finding="$($m.name) v$($m.version) @ $($_.FullName)"; Risk='CRITICAL'}
        }
    }
}
Get-ChildItem $ffProfiles -Recurse -Filter 'extensions.json' -Depth 2 | ForEach-Object {
    $j = Get-Content $_.FullName -Raw | ConvertFrom-Json
    foreach ($a in $j.addons) {
        foreach ($bad in $badExtNames) {
            if ($a.defaultLocale.name -like "*$bad*") {
                $report += [PSCustomObject]@{Check='Malicious-Extension-FF'; Finding="$($a.defaultLocale.name) [$($a.id)]"; Risk='CRITICAL'}
            }
        }
    }
}

# --- 4. Live connections / DNS cache hits to C2 ---
$c2 = @('studiotikva.com','bonto.run','j7tracker.io')
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 443,80 } | ForEach-Object {
    try {
        $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
        foreach ($d in $c2) { if ($dns -like "*$d*") {
            $proc = (Get-Process -Id $_.OwningProcess).ProcessName
            $report += [PSCustomObject]@{Check='Live-C2-Connection'; Finding="$proc -> $dns ($($_.RemoteAddress))"; Risk='CRITICAL'}
        }}
    } catch {}
}
Get-DnsClientCache | Where-Object { $e=$_.Entry; $c2 | Where-Object { $e -like "*$_*" } } | ForEach-Object {
    $report += [PSCustomObject]@{Check='DNS-Cache-Hit'; Finding="$($_.Entry) -> $($_.Data)"; Risk='HIGH'}
}

# --- 5. Run-key persistence referencing module names ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | ForEach-Object {
        if ($_.Value -match 'GoogleService|CommunicationUxTheme|rnp\.dll|texture\.dll') {
            $report += [PSCustomObject]@{Check='Persistence-RunKey'; Finding="$k :: $($_.Name)=$($_.Value)"; Risk='HIGH'}
        }
    }
}

# --- Output ---
if ($report) { $report | Format-Table -AutoSize; $report | Export-Csv ".\otx_hunt_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Host "[+] No indicators from 2026-09-10 OTX pulses found on this host." }