MATCHBOIL C# Downloader + Scattered Spider RMM Phishing + Help TDS: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Three concurrent OTX pulses reveal a converging threat landscape centered on initial access through social engineering and legitimate-tool abuse. Russia-aligned APT group UAC-0099 continues to evolve its custom C# downloader MATCHBOIL (with companion families MATCHWOK and LONEPAGE), conducting spearphishing campaigns against Ukrainian government, energy, transportation, manufacturing, finance, and media sectors. Development traces from April 2024 through April 2026 show sustained investment in obfuscation and payload delivery.

In parallel, Scattered Spider is running broad phishing campaigns distributing legitimate Remote Monitoring and Management (RMM) tools — ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able — as a living-off-the-land strategy to maintain remote access while blending into normal IT administration traffic. Finally, the Hotejka affiliate program (a rebrand of the ROI777 operation exposed in 2018) operates the Help Traffic Distribution System (TDS), leveraging Cloudflare Pages and predictive infrastructure to route victims into tech support scams that culminate in UltraViewer installation and persistent remote access.

Collectively, these campaigns share a common objective: establish durable remote access to victim environments — whether for nation-state espionage (UAC-0099), financially-motivated intrusion and data theft (Scattered Spider), or scam monetization and downstream fraud (Hotejka). The attack chains converge on phishing-based delivery, abuse of trusted binaries, and C2 or remote-access infrastructure that evades conventional signature detection.

Threat Actor / Malware Profile

UAC-0099 — MATCHBOIL / MATCHWOK / LONEPAGE

• Distribution: Targeted spearphishing emails delivering malicious attachments or links against Ukrainian entities.
• Payload behavior: MATCHBOIL is a custom C# downloader that retrieves follow-on payloads (MATCHWOK, LONEPAGE) from C2 servers, installs them, and configures the host for continued access.
• C2 communication: HTTP/HTTPS callbacks to actor-controlled domains including airarticlegenerate.com and virtualdailyplanner.pro.
• Persistence: Installs payloads and establishes persistence on victim machines (commonly via registry Run keys or scheduled tasks for .NET-based loaders).
• Anti-analysis: Early versions employed Unicode symbol obfuscation and custom string encryption; continuous development through 2026 indicates ongoing evasion refinement.

Scattered Spider — RMM Tool Abuse

• Distribution: Phishing campaigns using video-file lures and PDF/email attachments that deliver installers for ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able.
• Payload behavior: The RMM agents themselves are legitimate signed binaries; malicious intent is established through unauthorized deployment and attacker-controlled instances.
• C2 communication: RMM agents beacon to vendor cloud infrastructure or attacker-registered domains such as alertxen.store, bigsundoc.online, and ddncsoso.com.
• Persistence: RMM agents install as services with auto-start, providing resilient remote access.
• Anti-analysis: Abuse of signed, legitimate IT tools bypasses application allowlisting and many EDR heuristics.

Hotejka — Help TDS / UltraViewer

• Distribution: Help TDS (Traffic Distribution System) routes victims through Cloudflare Pages-hosted lures into tech support scam flows; infrastructure includes roi777.com, roi-traffic.icu, hotejka.ink, hotejka.com, lib1.biz, fosetya.shop, goalods.lol, hotcname.help.
• Payload behavior: Social engineering convinces victims to install UltraViewer, granting operators persistent remote desktop access for fraud, data theft, or further malware delivery.
• C2 communication: TDS infrastructure performs traffic routing and filtering; UltraViewer provides the access channel.
• Persistence: UltraViewer installs as a persistent remote-access application; call-center operators maintain access for repeat monetization.
• Anti-analysis: Use of Cloudflare Pages and predictive domain generation obscures infrastructure and frustrates takedown.

IOC Analysis

The pulses provide three indicator classes requiring distinct operational handling:

• Domains (C2 / phishing / TDS): airarticlegenerate.com, virtualdailyplanner.pro, alertxen.store, bigsundoc.online, ddncsoso.com, roi777.com, roi-traffic.icu, hotejka.ink, hotejka.com, lib1.biz, fosetya.shop, goalods.lol, hotcname.help. These should be blocked at DNS resolvers, secure web gateways, and email gateways. Feed them into SIEM watchlists for retrospective DNS query hunting.
• File hashes (SHA1 / MD5): MATCHBOIL and RMM-phishing payload hashes (e.g., SHA1 050926727cdd74f0b3a8a098e60b76d10fb06b14, MD5 0f44f21b4175d8e7a5945bc0c6fda97d, MD5 1017a75cf19be75f6ba21148a9b646d1). Hashes are brittle — useful for confirming known samples via EDR file reputation, VirusTotal/OTX lookups, and retro-hunts, but expect recompilation.
• Behavioral indicators: Because RMM abuse relies on legitimate binaries, hash-based detection alone fails. SOC teams must pair IOCs with behavioral detections: unauthorized RMM process execution, unexpected outbound connections to RMM vendor infrastructure, and .NET downloaders spawning installers.

Operationalization: Ingest indicators into your threat intel platform (MISP, OpenCTI, or native SIEM TI feeds), push domains to DNS sinkholes/proxy blocklists, load hashes into EDR blocklists, and build watchlists for the RMM vendor process names (ScreenConnect*.exe, fleetdeck*.exe, SimpleHelp*.exe, ultraviewer*.exe).

Detection Engineering

---
title: MATCHBOIL C# Downloader Execution and C2 Activity
description: Detects execution of MATCHBOIL downloader artifacts and network communication to known UAC-0099 C2 domains observed in OTX pulse.
status: experimental
date: 2026/11/08
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname:
      - airarticlegenerate.com
      - virtualdailyplanner.pro
  condition: selection_domain
falsepositives:
  - None expected for these dedicated C2 domains
level: high
tags:
  - attack.command_and_control
  - attack.t1071
---
title: Unauthorized RMM Tool Execution (ScreenConnect, FleetDeck, SimpleHelp, UltraViewer)
description: Detects execution of remote monitoring and management tools commonly abused by Scattered Spider and Help TDS operators when not part of approved IT tooling.
status: experimental
date: 2026/11/08
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\fleetdeck_agent.exe'
      - '\SimpleService.exe'
      - '\SimpleHelp.exe'
      - '\UltraViewer.exe'
      - '\Datto RMM.exe'
  filter_approved:
    Image|startswith:
      - 'C:\Program Files\ApprovedIT\'
  condition: selection_img and not filter_approved
falsepositives:
  - Legitimate IT administration; tune filter_approved to your sanctioned RMM paths
level: medium
tags:
  - attack.command_and_control
  - attack.t1219
---
title: Help TDS Infrastructure DNS Resolution
description: Detects DNS queries to Hotejka Help TDS domains associated with tech support scam traffic distribution.
status: experimental
date: 2026/11/08
author: Security Arsenal
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - roi777.com
      - roi-traffic.icu
      - hotejka.ink
      - hotejka.com
      - lib1.biz
      - fosetya.shop
      - goalods.lol
      - hotcname.help
  condition: selection
falsepositives:
  - Security research or threat intel validation
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001

// Hunt: RMM tool network activity + known phishing/C2 domains
let rmm_processes = dynamic(["ScreenConnect", "fleetdeck", "SimpleHelp", "UltraViewer", "Datto", "jumpcloud", "n-able"]);
let bad_domains = dynamic(["airarticlegenerate.com", "virtualdailyplanner.pro", "alertxen.store", "bigsundoc.online", "ddncsoso.com", "roi777.com", "roi-traffic.icu", "hotejka.ink", "hotejka.com", "lib1.biz", "fosetya.shop", "goalods.lol", "hotcname.help"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (bad_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName has_any (rmm_processes)
    | where not (FolderPath has_any ("C:\\Program Files\\ApprovedIT"))
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, AccountName)
| sort by TimeGenerated desc

# IOC Hunt: MATCHBOIL persistence + RMM/UltraViewer artifacts + C2 connections
$ErrorActionPreference = 'SilentlyContinue'

Write-Host "=== [1] Checking Run-key persistence for suspicious entries ==="
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
  Get-ItemProperty -Path $key | ForEach-Object {
    $_.PSObject.Properties | Where-Object {
      $_.Value -match 'AppData|Temp|Roaming' -and $_.Value -match '\.exe'
    } | ForEach-Object { Write-Host "[!] $key :: $($_.Name) = $($_.Value)" }
  }
}

Write-Host "`n=== [2] Scheduled tasks referencing user-writable paths ==="
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'AppData|Temp' -or $_.Actions.Arguments -match 'AppData|Temp'
} | ForEach-Object { Write-Host "[!] Task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

Write-Host "`n=== [3] RMM / UltraViewer processes and services ==="
$rmmNames = 'ScreenConnect','fleetdeck','SimpleHelp','SimpleService','UltraViewer','Datto','dwrcs','nmsrvc'
Get-Process | Where-Object { $n=$_.ProcessName; $rmmNames | Where-Object { $n -match $_ } } |
  ForEach-Object { Write-Host "[!] Process: $($_.ProcessName) (PID $($_.Id)) Path: $($_.Path)" }
Get-Service | Where-Object { $n=$_.Name; $rmmNames | Where-Object { $n -match $_ } } |
  ForEach-Object { Write-Host "[!] Service: $($_.Name) [$($_.Status)] $($_.DisplayName)" }

Write-Host "`n=== [4] Active connections to known C2 / TDS infrastructure ==="
$badHosts = @('airarticlegenerate.com','virtualdailyplanner.pro','alertxen.store','bigsundoc.online','ddncsoso.com','roi777.com','roi-traffic.icu','hotejka.ink','hotejka.com','lib1.biz','fosetya.shop','goalods.lol','hotcname.help')
foreach ($h in $badHosts) {
  $ips = (Resolve-DnsName -Name $h -Type A).IPAddress
  foreach ($ip in $ips) {
    $conn = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $ip -and $_.State -eq 'Established' }
    if ($conn) { $conn | ForEach-Object { Write-Host "[!!!] ACTIVE CONNECTION to $h ($ip) from PID $($_.OwningProcess)" } }
  }
}

Write-Host "`n=== [5] Hash sweep of common staging dirs (MATCHBOIL / phishing payloads) ==="
$badHashes = @('0f44f21b4175d8e7a5945bc0c6fda97d','da8b86308e499493552f22bf2ea30d83','1017a75cf19be75f6ba21148a9b646d1','1562d523c2ebdc19c0ff8f3ea5f3763b','594a652263e5e4eb96b5164d337bc1ca','5a49d0b22ced22f9cf8b2015a327f163','5ac7526b582d9cf4f7854c52ee75f359')
$dirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public\Downloads")
foreach ($d in $dirs) {
  Get-ChildItem -Path $d -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
    if ($badHashes -contains $h) { Write-Host "[!!!] HASH MATCH: $($_.FullName) [$h]" }
  }
}
Write-Host "`nHunt complete."

Response Priorities

Immediate (0–4 hours)

• Block all listed domains at DNS resolver, secure web gateway, and email gateway; sinkhole where possible for visibility.
• Push file hashes to EDR blocklists; trigger retro-hunts across the last 30 days.
• Run the PowerShell hunt script on internet-facing and high-value endpoints; sweep for unauthorized RMM/UltraViewer installations and remove any instance not in your approved software inventory.
• Search email logs for spearphishing indicators targeting Ukrainian-interest personnel or video-file/PDF lures.

24 Hours

• Because RMM/remote-access compromise frequently precedes credential theft: force password resets and revoke active sessions (Entra ID/AD tokens) for any user whose host shows RMM execution or C2 contact; verify MFA registration events for tampering — Scattered Spider is known for MFA fatigue and help-desk social engineering.
• Review help-desk ticket and call logs for suspicious password/MFA reset requests in the past 14 days.
• Validate no unauthorized accounts were created; audit privileged group membership changes.

1 Week

• Implement application control (WDAC/AppLocker) restricting RMM tools to an explicit allowlist of approved vendor binaries and paths.
• Deploy the Sigma and KQL detections into production with tuned approved-path filters.
• Restrict outbound traffic for endpoints to approved RMM vendor infrastructure only; alert on first-seen remote-access tooling.
• Harden the service desk: require out-of-band verification (callback to known number, manager approval) for credential and MFA resets; conduct targeted phishing awareness for finance, executive assistants, and IT staff.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub