Multi-Actor APT Campaigns Targeting Banking & Infrastructure: ValleyRAT, Havoc, and Supply Chain Attacks — Detection & Response Brief

---
title: ValleyRAT C2 Traffic Detection
id: 47f8d294-c5ce-42b8-9b1a-6d6a9c1d8e3e
description: Detects C2 communication patterns associated with ValleyRAT malware
status: experimental
author: Security Arsenal
date: 2026/07/10
references:
    - https://otx.alienvault.com/pulse/67a7b4d6e1b70d4a0d8c9e3a7c4b1d8e
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: zeek
    service: http
detection:
    selection:
        uri|contains:
            - '/api/v1'
            - '/cmd'
        host|endswith:
            - '.tech'
            - '.live'
    filter:
        user_agent|contains:
            - 'Mozilla'
            - 'Windows'
    condition: selection and not filter
falsepositives:
    - Legitimate API traffic to tech domains
level: high
---
title: Havoc Framework Process Injection
date: 2026/07/10
description: Detects potential process injection techniques used by Havoc framework
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67a7b4d6e1b70d4a0d8c9e3a7c4b1d8e
tags:
    - attack.defense_evasion
    - attack.t1055.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ObjectType: 'Process'
        AccessMask|contains:
            - 'PROCESS_VM_WRITE'
            - 'PROCESS_VM_OPERATION'
        SubjectUserName|contains:
            - 'SYSTEM'
            - 'ADMIN'
    condition: selection
falsepositives:
    - Legitimate system administration tools
level: high
---
title: Malicious NPM Package Wallet Key Exfiltration
date: 2026/07/10
description: Detects suspicious network activity from compromised Injective SDK npm package
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67a7b4d6e1b70d4a0d8c9e3a7c4b1d8e
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    product: azure
    service: azureactivity
detection:
    selection:
        OperationName|contains: 'Microsoft.Network/networkSecurityGroups/write'
    filter:
        CallerIpAddress|contains:
            - 'injective.network'
            - 'grpc-web'
    condition: selection and not filter
falsepositives:
    - Legitimate development activity
level: high


kql
// Hunt for ValleyRAT C2 traffic
DeviceNetworkEvents
| where RemoteUrl in ("emezonhe.me", "skycloudcenter.com", "dog3rj.tech", "q74vn.live") 
   or RemoteIP in ("188.127.251.171", "59.110.7.32")
| summarize count() by DeviceName, RemoteUrl, RemoteIP
| sort by count_ desc

// Hunt for Havoc Framework process injection
DeviceProcessEvents
| where InitiatingProcessCommandLine contains "powershell" and 
   ProcessCommandLine contains "Invoke-WebRequest" and
   ProcessCommandLine contains any("emezonhe.me", "skycloudcenter.com", "dog3rj.tech", "q74vn.live")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName

// Hunt for compromised npm package activity
DeviceFileEvents
| where SHA256 in ("103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0", 
                   "9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName

// Hunt for ProxyShell exploitation indicators
DeviceProcessEvents
| where ProcessName endswith "powershell.exe" and
   ProcessCommandLine contains "Set-Mailbox" and
   ProcessCommandLine contains "-WindowsEmailAddress"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine


powershell
# IOC Hunt for ValleyRAT and Havoc Framework
$C2Domains = @("emezonhe.me", "skycloudcenter.com", "dog3rj.tech", "q74vn.live", "testnet.archival.chain.grpc-web.injective.network")
$C2IPs = @("188.127.251.171", "59.110.7.32")
$MaliciousHashes = @(
    "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a",
    "103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0",
    "9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9"
)

# Check for network connections to C2 infrastructure
Write-Host "Checking for connections to known C2 infrastructure..." -ForegroundColor Yellow
Get-NetTCPConnection | Where-Object {
    $C2IPs -contains $_.RemoteAddress
} | Format-Table

# Check for malicious files
Write-Host "Scanning for malicious file hashes..." -ForegroundColor Yellow
$Drives = Get-PSDrive -PSProvider FileSystem
foreach ($Drive in $Drives) {
    Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | Where-Object {
        $MaliciousHashes -contains $_.Hash
    } | Select-Object FullName, Hash
}

# Check for suspicious scheduled tasks
Write-Host "Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object {
    $_.TaskName -like "*update*" -or 
    $_.TaskName -like "*service*" -or 
    $_.Actions.Execute -like "*powershell*"
} | Select-Object TaskName, TaskPath, Actions

# Check DNS cache for C2 domains
Write-Host "Checking DNS cache for C2 domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object {
    $C2Domains -contains $_.Entry
} | Format-Table

# Check for compromised npm package
Write-Host "Checking for compromised npm package..." -ForegroundColor Yellow
$NpmPackages = Get-ChildItem -Path "C:\Users\*\AppData\Roaming\npm" -Recurse -ErrorAction SilentlyContinue
foreach ($Package in $NpmPackages) {
    if ($Package.Name -like "*injective*" -and $Package.Version -eq "1.20.21") {
        Write-Host "Potential malicious package found: $($Package.FullName)" -ForegroundColor Red
    }
}