Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack

---
title: NEBULA Malicious npm Package Install Spawning Windows Payload
id: 8f3a2b11-4c6e-4d2a-9b5e-1a7c9e2f3d01
status: experimental
description: Detects node/npm processes spawning script interpreters or executables consistent with KNTRAT delivery from malicious NebulaAI npm packages (api-nebula, llm-nebula).
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://cdn.cloudsek.com/cloudsek-blog-pdfs/cloudsek-neb-qhe.pdf
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\npm.exe'
            - '\cmd.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    filter_npm_scripts:
        CommandLine|contains:
            - 'npm run'
            - 'npm test'
    condition: selection_parent and selection_child and not filter_npm_scripts
falsepositives:
    - Legitimate npm install scripts invoking build tooling
level: high
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.execution
---
title: KNTRAT C2 Communication to NebulaAI Infrastructure
id: 2b7d4c55-9e1f-4a3b-8c6d-5f2a8b1e4d02
status: experimental
description: Detects network connections to KNTRAT command-and-control infrastructure identified in OTX NEBULA pulse.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://cdn.cloudsek.com/cloudsek-blog-pdfs/cloudsek-neb-qhe.pdf
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'nebulaai.dev'
    selection_ip:
        DestinationIp:
            - '65.87.7.132'
    condition: selection_domain or selection_ip
falsepositives:
    - None expected; domain is actor-controlled
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Android Ransomware Permission Abuse Pattern - Mantax Otax
id: 5c1e8f33-7a2d-4b4c-9d8e-3f6a1b2c5d03
status: experimental
description: Detects installation of APKs requesting the device administrator, SMS, contacts, and accessibility permission combination characteristic of Mantax Otax mobile ransomware. Deploy via MDM/mobile EDR telemetry forwarded to SIEM.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://zimperium.com/blog/mantax-otax-indonesian-mobile-ransomware-with-spyware-integration
logsource:
    product: android
    service: package_install
detection:
    selection_permissions:
        RequestedPermissions|contains|all:
            - 'android.permission.BIND_DEVICE_ADMIN'
            - 'android.permission.READ_SMS'
            - 'android.permission.READ_CONTACTS'
            - 'android.permission.BIND_ACCESSIBILITY_SERVICE'
    selection_source:
        InstallerPackage|not_contains:
            - 'com.android.vending'
            - 'com.google.android.gms'
    condition: selection_permissions and selection_source
falsepositives:
    - Legitimate MDM or enterprise security agents sideloaded during enrollment
level: high
tags:
    - attack.impact
    - attack.t1486
    - attack.collection

// NEBULA / KNTRAT hunt: npm installs of malicious NebulaAI packages and C2 egress
let BadPkgs = dynamic(["api-nebula","llm-nebula"]);
let BadInfra = dynamic(["api.nebulaai.dev","65.87.7.132","fact-register.md"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (BadInfra) or RemoteIP == "65.87.7.132"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any (BadPkgs)
       or (InitiatingProcessFileName in~ ("npm.exe","node.exe","npm.cmd")
           and FileName in~ ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has "node_modules" and FolderPath has_any (BadPkgs)
       or FileName =~ "fact-register.md"
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName
)
| sort by TimeGenerated desc

# NEBULA / KNTRAT IOC Hunt Script — Security Arsenal
# Run elevated on developer workstations, build agents, and CI runners.
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

Write-Host "[1/5] Checking npm global/local packages for malicious NebulaAI SDK..." -ForegroundColor Cyan
$badPkgs = @('api-nebula','llm-nebula')
foreach ($pkg in $badPkgs) {
    $installed = npm ls -g $pkg 2>$null
    if ($installed -match $pkg) {
        $findings += [PSCustomObject]@{Type='npm-global'; Indicator=$pkg; Detail=$installed}
    }
}
# Scan node_modules trees in common dev roots
$roots = @("$env:USERPROFILE\source","$env:USERPROFILE\repos","$env:USERPROFILE\projects","C:\agent\_work","C:\build")
foreach ($root in $roots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Depth 6 -Directory -Filter 'node_modules' |
            ForEach-Object {
                Get-ChildItem $_.FullName -Directory | Where-Object { $_.Name -match 'nebula' } |
                    ForEach-Object { $findings += [PSCustomObject]@{Type='node_modules'; Indicator=$_.Name; Detail=$_.FullName} }
            }
    }
}

Write-Host "[2/5] Checking known KNTRAT file hashes..." -ForegroundColor Cyan
$badHashes = @(
    '5222dd57b8859e791a16abcf7f616bbc59f8cf248798c7c8c2ba800f0b52cd8c',
    '8bc90df9b387849338d9c61a8d379cfbb0d70ea576c0e37e1fb07ba164921807',
    'e99bab7b8bbbde7c821dae4ccfedfd1e608d65c466de9b08037c5ce5f56af3b1',
    'f0d36ac2d75c81a4c3cbdbf2f717db858f2876e6a1cc74f2d36b729a1dd51a5e'
)
foreach ($root in $roots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -File -Include *.exe,*.js,*.dll |
            ForEach-Object {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
                if ($badHashes -contains $h) {
                    $findings += [PSCustomObject]@{Type='hash-match'; Indicator=$h; Detail=$_.FullName}
                }
            }
    }
}

Write-Host "[3/5] Checking active network connections to KNTRAT C2..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemoteAddress -eq '65.87.7.132'
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $findings += [PSCustomObject]@{Type='c2-connection'; Indicator=$_.RemoteAddress; Detail="PID $($_.OwningProcess) - $($proc.ProcessName)"}
}

Write-Host "[4/5] Checking DNS cache for nebulaai.dev resolution..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $_.Entry -match 'nebulaai\.dev' } |
    ForEach-Object { $findings += [PSCustomObject]@{Type='dns-cache'; Indicator=$_.Entry; Detail=$_.Data} }

Write-Host "[5/5] Checking persistence locations for suspicious node/npm-launched entries..." -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty $key -Name $_.Name).$($_.Name)
        if ($val -match 'node|npm|nebula') {
            $findings += [PSCustomObject]@{Type='persistence'; Indicator=$_.Name; Detail="$key = $val"}
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'node|npm' } |
    ForEach-Object { $findings += [PSCustomObject]@{Type='scheduled-task'; Indicator=$_.TaskName; Detail=$_.Actions.Execute} }

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\nebular_kntrat_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings exported to CSV. Escalate to IR immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No KNTRAT/NEBULA indicators found on this host." -ForegroundColor Green
}