Miasma Worm v3 npm Supply-Chain Attack + Tomorrowland Credential-Harvesting Scam Network: OTX Pulse Analysis — Detection Pack

---
title: Miasma v3 npm Worm - Suspicious Package Install Network Beacon
id: 7f3a1c2e-9b4d-4e1f-a8c5-2d6b9e0f1a34
status: experimental
description: Detects Node.js/npm processes initiating outbound connections to known Miasma v3 C2 infrastructure or uncommon high ports shortly after package installation.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://research.jfrog.com/post/miasma-worm-returns-to-npm/
logsource:
    category: network_connection
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\npm.exe'
    selection_c2:
        DestinationIp: '85.137.53.71'
    selection_ports:
        DestinationPort:
            - 8080
            - 8081
            - 8091
    condition: selection_image and (selection_c2 or selection_ports)
falsepositives:
    - Legitimate local development servers on ports 8080/8081
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1195.002
---
title: Miasma v3 - Developer Credential Store Access by Node Process
id: 4c8e2b1a-6d3f-4a9c-b7e2-1f5d8c0a3b67
status: experimental
description: Detects node/npm processes reading developer secret stores (npmrc, SSH keys, AWS/Azure/GCP credentials) consistent with Miasma worm credential harvesting behavior.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://research.jfrog.com/post/miasma-worm-returns-to-npm/
logsource:
    category: file_event
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\node.exe'
            - '\npm.exe'
            - '\npm.cmd'
    selection_target:
        TargetFilename|contains:
            - '\.npmrc'
            - '\.ssh\id_'
            - '\.aws\credentials'
            - '\.azure\'
            - '\gcloud\credentials'
    condition: selection_image and selection_target
falsepositives:
    - Legitimate npm publish/login operations; validate against change windows
level: critical
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1078
---
title: Tomorrowland Fraud Domain Resolution - Typosquat DNS Query
id: 9a1d5f3c-2e7b-4c8d-a6f1-3b9e4d2c7a15
status: experimental
description: Detects DNS queries for known Tomorrowland 2026 fraudulent ticketing domains used in credential and payment harvesting scams.
author: Security Arsenal Threat Intelligence
date: 2026/08/14
references:
    - https://www.cloudsek.com/blog/tomorrowland-2026-fake-ticket-scams-belgium
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'tomorrowland-booking.com'
            - 'belgium-tomorrowlland.com'
            - 'belgium-tomorrowlland.info'
            - 'belgiumtomoorrowland.com'
            - 'festreisen.com'
            - 'jedemenatomorrowland.cz'
            - 'mcsdirect.tech'
            - 'tmrlnd.shop'
    condition: selection
falsepositives:
    - Threat research and sandbox detonation
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1583.001

// Miasma v3 C2 + Tomorrowland fraud domain hunt - Microsoft Sentinel
let miasma_c2 = dynamic(["85.137.53.71"]);
let scam_domains = dynamic([
    "tomorrowland-booking.com", "belgium-tomorrowlland.com",
    "belgium-tomorrowlland.info", "belgiumtomoorrowland.com",
    "festreisen.com", "jedemenatomorrowland.cz",
    "mcsdirect.tech", "tmrlnd.shop"
]);
let c2_connections =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (miasma_c2)
       or RemotePort in (8080, 8081, 8091) and InitiatingProcessFileName has_any ("node", "npm")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
    | extend HuntType = "Miasma C2 Beacon";
let scam_dns =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (scam_domains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
    | extend HuntType = "Tomorrowland Fraud Domain";
let secret_access =
    DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where InitiatingProcessFileName has_any ("node.exe", "npm.cmd", "npm.exe")
    | where FileName has_any (".npmrc", "id_rsa", "id_ed25519", "credentials")
       or FolderPath has_any ("\\.ssh\\", "\\.aws\\", "\\.azure\\", "gcloud")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
    | extend HuntType = "Developer Secret Access by Node";
union c2_connections, scam_dns, secret_access
| sort by TimeGenerated desc

# Security Arsenal - Miasma v3 + Tomorrowland Fraud IOC Hunt Script
# Run elevated on developer workstations / CI runners. Outputs findings to CSV.

$findings = @()
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

Write-Host "[*] Security Arsenal IOC Hunt - Miasma v3 / Tomorrowland Scam Network" -ForegroundColor Cyan

# --- 1. Check for compromised AsyncAPI packages in node_modules and lockfiles ---
Write-Host "[1/5] Scanning for compromised AsyncAPI packages..." -ForegroundColor Yellow
$suspectPkgs = @("@asyncapi/generator", "@asyncapi/generator-helpers", "@asyncapi/generator-components", "@asyncapi/specs")
$searchRoots = @("$env:USERPROFILE", "C:\dev", "C:\projects", "C:\actions-runner", "C:\buildAgent")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        foreach ($pkg in $suspectPkgs) {
            $hits = Get-ChildItem -Path $root -Recurse -Directory -Filter ($pkg.Split('/')[1]) -ErrorAction SilentlyContinue -Depth 6 |
                Where-Object { $_.FullName -like "*asyncapi*" }
            foreach ($hit in $hits) {
                $findings += [PSCustomObject]@{
                    Time = $timestamp; Type = "Suspect npm Package"
                    Detail = $hit.FullName; Severity = "CRITICAL - Verify version against JFrog advisory"
                }
            }
        }
    }
}

# --- 2. Check active and historical network connections to Miasma C2 ---
Write-Host "[2/5] Checking network connections to Miasma C2 (85.137.53.71)..." -ForegroundColor Yellow
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq "85.137.53.71" }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $findings += [PSCustomObject]@{
        Time = $timestamp; Type = "C2 Connection (LIVE)"
        Detail = "$($proc.ProcessName) (PID $($c.OwningProcess)) -> 85.137.53.71:$($c.RemotePort)"
        Severity = "CRITICAL - Isolate host immediately"
    }
}

# --- 3. Check DNS cache for Tomorrowland fraud domains ---
Write-Host "[3/5] Checking DNS cache for fraud domains..." -ForegroundColor Yellow
$fraudDomains = @("tomorrowland-booking.com","belgium-tomorrowlland.com","belgium-tomorrowlland.info",
                  "belgiumtomoorrowland.com","festreisen.com","jedemenatomorrowland.cz","mcsdirect.tech","tmrlnd.shop")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $fraudDomains) {
    $match = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($match) {
        $findings += [PSCustomObject]@{
            Time = $timestamp; Type = "Fraud Domain in DNS Cache"
            Detail = $d; Severity = "HIGH - User may have visited scam site; check for card/credential entry"
        }
    }
}

# --- 4. Detect recent modification of developer credential stores (possible theft staging) ---
Write-Host "[4/5] Checking credential stores for recent anomalous access..." -ForegroundColor Yellow
$secretPaths = @("$env:USERPROFILE\.npmrc","$env:USERPROFILE\.ssh","$env:USERPROFILE\.aws\credentials","$env:USERPROFILE\.azure")
foreach ($p in $secretPaths) {
    if (Test-Path $p) {
        $item = Get-Item $p -ErrorAction SilentlyContinue
        if ($item.LastAccessTime -gt (Get-Date).AddDays(-14)) {
            $findings += [PSCustomObject]@{
                Time = $timestamp; Type = "Recent Secret Store Access"
                Detail = "$p last accessed $($item.LastAccessTime)"
                Severity = "MEDIUM - Correlate with node/npm process telemetry"
            }
        }
    }
}

# --- 5. Check for suspicious npm postinstall persistence (scheduled tasks / run keys spawned near install time) ---
Write-Host "[5/5] Checking persistence mechanisms..." -ForegroundColor Yellow
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    if (Test-Path $rk) {
        $vals = Get-ItemProperty $rk -ErrorAction SilentlyContinue
        $vals.PSObject.Properties | Where-Object { $_.Value -match "node|npm|\.js" } | ForEach-Object {
            $findings += [PSCustomObject]@{
                Time = $timestamp; Type = "Suspicious Run Key"
                Detail = "$rk :: $($_.Name) = $($_.Value)"; Severity = "HIGH - Possible npm-delivered persistence"
            }
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "node|npm" -and $_.Date -gt (Get-Date).AddDays(-45)
} | ForEach-Object {
    $findings += [PSCustomObject]@{
        Time = $timestamp; Type = "Suspicious Scheduled Task"
        Detail = "$($_.TaskName) -> $($_.Actions.Execute)"; Severity = "HIGH"
    }
}

# --- Output ---
if ($findings.Count -gt 0) {
    $out = ".\arsenal_ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $findings | Export-Csv -Path $out -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings written to $out" -ForegroundColor Red
    $findings | Format-Table -AutoSize
} else {
    Write-Host "[+] No IOC matches found on this host." -ForegroundColor Green
}