Multi-Vector RaaS and Supply Chain Attacks: Bumblebee, The Gentlemen, and JINX-0164 OTX Pulse Analysis

---
title: Potential Bumblebee Loader via Trojanized Admin Tools
id: 8a9b2c1d-4e5f-6789-0123-456789abcdef
description: Detects potential Bumblebee execution initiated via trojanized installers distributed via SEO poisoning targeting IT admin tools.
status: stable
author: Security Arsenal
date: 2026/07/01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|contains:
            - 'OpManager'
            - 'ManageEngine'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripting
level: high
---
title: The Gentlemen Reconnaissance Activity
description: Detects reconnaissance tools utilized by The Gentlemen group such as SharpADWS or Advanced IP Scanner.
status: stable
author: Security Arsenal
date: 2026/07/01
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith:
            - '\Advanced_IP_Scanner.exe'
            - '\netsh.exe'
    selection_recon:
        Image|endswith: '\SharpADWS.exe'
    condition: 1 of selection*
falsepositives:
    - Authorized network scanning
level: medium
---
title: JINX-0164 macOS Python C2 Activity
description: Detects Python processes on macOS establishing network connections associated with JINX-0164 tools like AUDIOFIX.
status: stable
author: Security Arsenal
date: 2026/07/01
logsource:
    category: network_connection
    product: macos
detection:
    selection:
        Image|endswith: '/python' 
        Initiated: 'true'
    filter_legit_ports:
        DestinationPort:
            - 80
            - 443
            - 22
    filter_legit_domains:
        DestinationHostname|endswith:
            - 'apple.com'
            - 'github.com'
            - 'microsoft.com'
    condition: selection and not filter_legit_ports and not filter_legit_domains
falsepositives:
    - Legitimate python development
level: high

// Hunt for IOCs from OTX Pulses (The Gentlemen, Bumblebee, JINX-0164)
let IoC_Domains = dynamic(["angryipscanner.org", "opmanager.pro", "driver-updater.net", "live.ong", "login.teamicrosoft.com"]);
let IoC_IPs = dynamic(["172.96.137.160", "89.36.224.5"]);
let IoC_Hashes = dynamic(["a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b", "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"]);

// Network Connection Hunt
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatContext = case(
    RemoteUrl has "opmanager", "Bumblebee SEO Poisoning",
    RemoteIP == "172.96.137.160", "Bumblebee/Akira C2",
    RemoteUrl has "driver-updater", "JINX-0164 Infrastructure",
    "Unknown Match"
)

// File Hash Hunt
| union (
    DeviceProcessEvents
    | where SHA256 in (IoC_Hashes) or MD5 in (IoC_Hashes) or SHA1 in (IoC_Hashes)
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256, MD5
)

# Security Arsenal - IOC Hunt Script for OTX Pulses (Bumblebee, The Gentlemen, JINX-0164)

$TargetHashes = @(
    "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", # Bumblebee/Akira
    "a746da514c90f26a187a294fda7edc1b", # Bumblebee/Akira
    "bcee0ab10b23f5999bcdb56c0b4a631a", # The Gentlemen
    "9321a61a25c7961d9f36852ecaa86f55", # The Gentlemen
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17" # JINX-0164
)

$TargetDomains = @(
    "angryipscanner.org",
    "opmanager.pro",
    "driver-updater.net",
    "live.ong",
    "login.teamicrosoft.com"
)

Write-Host "[+] Starting IOC Hunt for OTX Pulse Data..." -ForegroundColor Cyan

# 1. Check Processes for Malicious Hashes
Write-Host "[*] Scanning running processes..." -ForegroundColor Yellow
Get-Process | Where-Object { $_.Path -ne $null } | ForEach-Object {
    try {
        $hash = (Get-FileHash -Path $_.Path -Algorithm SHA256 -ErrorAction Stop).Hash
        if ($TargetHashes -contains $hash) {
            Write-Host "[!] ALERT: Malicious process detected - $($_.ProcessName) (PID: $($_.Id))" -ForegroundColor Red
        }
    } catch {}
}

# 2. Scan User Download Directories for Malicious Files
Write-Host "[*] Scanning user directories for malicious files..." -ForegroundColor Yellow
$Paths = @("C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($TargetHashes -contains $hash) {
                    Write-Host "[!] ALERT: Malicious file found at $($_.FullName)" -ForegroundColor Red
                }
            } catch {}
        }
    }
}

# 3. Check DNS Cache for Indicator Domains
Write-Host "[*] Checking DNS Cache for malicious domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $TargetDomains -contains $_.Entry } | ForEach-Object {
    Write-Host "[!] ALERT: Suspicious DNS entry resolved: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}

# 4. Check for established connections to Bumblebee C2 IP
Write-Host "[*] Checking network connections to 172.96.137.160..." -ForegroundColor Yellow
$connection = netstat -ano | Select-String "172.96.137.160"
if ($connection) {
    Write-Host "[!] ALERT: Active connection to Bumblebee C2 detected." -ForegroundColor Red
    Write-Host $connection
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green