Back to Intelligence

N0n AI-Assisted Ransomware + NetamLoader Government Supply-Chain APT + Brazilian Magecart Skimmer: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
October 29, 2026
10 min read

Three concurrent OTX pulses paint a picture of a threat landscape that is simultaneously commoditizing and professionalizing. The n0n ransomware operation represents the maturation of AI-assisted cybercrime: a single operator leveraging paid LLM coding agents (with over $7,000 in API spend on a single exposed staging server) to develop encryptors, breach tooling, and extortion infrastructure at a scale previously requiring a full development team. At least 23 victim organizations across 14 countries were identified — spanning retail, healthcare, government, finance, and education — with initial access traced to FortiGate SSL-VPN exploitation and credential stuffing, followed by data exfiltration, backup destruction, and destructive extortion.

In parallel, an unknown APT is deploying NetamLoader against a customized Windows 10 build used exclusively by Asian government entities. This is a precision supply-chain operation: a malicious CAB archive staged in Windows update directories, executing through XAML markup, .NET assemblies, AppDomainManager injection, and BinaryFormatter deserialization — with AMSI bypass built in. The tradecraft (multi-stage in-memory chains, living-off-trusted-update-paths) signals a nation-state-tier operator with insider knowledge of the target platform's build process.

The third pulse tracks a Brazilian Magecart group (active since 2024) executing a third-party script supply-chain attack: injecting a card skimmer into the Plausible analytics tracker served from analytics.convertr.app.br. Since October 24, 2026, every Convertr checkout has silently exfiltrated card numbers, CVVs, expiry dates, cardholder names, and CPF taxpayer IDs. CVE-2026-8467 is associated with the compromise vector.

Collectively: initial access via edge-VPN exploitation, trusted software update channels, and third-party web scripts. All three campaigns abuse implicit trust in infrastructure you already operate.

Threat Actor / Malware Profile

n0n Ransomware (Operator: "N0n")

  • Distribution: FortiGate SSL-VPN exploitation and credential stuffing against exposed remote access services; staging infrastructure hosted on bulletproof VPS (observed IPs in 198.13.x.x, 217.18.x.x, 45.132.x.x ranges).
  • Payload behavior: AI-generated encryptor source code recovered from the exposed workspace; destructive extortion model with deliberate backup destruction prior to encryption to eliminate recovery leverage.
  • C2 / Extortion: Dedicated extortion infrastructure; exfiltration staged before detonation. Beaconing infrastructure observed masquerading as NTP sync services (e.g., the ntpsync.io subdomain pattern).
  • Anti-analysis: LLM coding agent used to iterate tooling rapidly — expect high variant churn and polymorphic encryptor builds that defeat static signatures.
  • Persistence: Not detailed in pulse; assume standard ransomware operator playbook (run keys, scheduled tasks, service creation) post-initial-access.

NetamLoader (Unknown APT — Asian Government Targeting)

  • Distribution: Supply-chain compromise of a government-customized Windows 10 build; malicious CAB archive planted in Windows update directories (associated CVEs: CVE-2026-109618, CVE-2026-109619).
  • Payload behavior: Multi-stage infection chain: XAML markup loading .NET assemblies, AppDomainManager injection, and BinaryFormatter deserialization to execute follow-on stages in memory.
  • C2: Infrastructure includes typosquatted/impersonation domains such as openaigpt4v.com, blending malicious traffic into AI-service noise.
  • Persistence: Trusted update-path placement provides implicit execution privilege and survivability across reboots; AppDomainManager hijack persists across .NET application launches.
  • Anti-analysis: AMSI bypass is explicitly implemented; in-memory .NET execution minimizes disk artifacts; abuse of legitimate Windows update directories evades path-based allowlisting assumptions.

Brazilian Magecart (Convertr/Plausible Skimmer)

  • Distribution: Supply-chain injection into the Plausible analytics script loaded by Convertr checkouts (analytics.convertr.app.br); active since 2026-10-24.
  • Payload behavior: JavaScript form-jacking skimmer harvesting PAN, CVV, expiry, cardholder name, and Brazilian CPF numbers; exfiltration over WebSocket to attacker infrastructure (wss://1x0.is/ws).
  • C2: WebSocket-based exfil to 1x0.is, with supporting/redirector domains including ecomscan.com, antiddos-protection.net, and deepveindrilling.com.
  • Persistence: Lives in the third-party script — no endpoint persistence required; reinfection is automatic on every checkout page load until the script is remediated.
  • Anti-analysis: Skimmer concealed inside a legitimate analytics library; exfil blended into plausible tracker telemetry.

IOC Analysis

The indicator set spans four operational layers, and each demands different handling:

  • IPv4 (n0n): 198.13.158.143, 217.18.55.185, 45.132.114.241 — VPS-hosted staging/extortion infrastructure. Operationalize via egress firewall deny rules and retroactive NetFlow/proxy log review for any outbound sessions. These IPs are high-confidence, moderate-ephemerality: block immediately, but expect rotation.
  • Hostnames/Domains: openaigpt4v.com (NetamLoader C2, AI-service impersonation), ecomscan.com, antiddos-protection.net, deepveindrilling.com (Magecart exfil/redirectors), and the ntpsync.io beaconing subdomain (n0n). Feed to DNS sinkhole and secure web gateway. The openaigpt4v.com pattern warrants a broader hunt: alert on DNS queries matching AI-brand typosquats from non-browser processes.
  • URLs (Magecart): http(s)://1x0.is/ws — WebSocket exfil channel. Hunt proxy/ZTNA logs for WebSocket upgrade requests to non-standard destinations from ecommerce-adjacent infrastructure; inspect for Connection: Upgrade headers to unknown hosts.
  • File hashes: MD5 set for NetamLoader stages (4f28622c5e60c01319bf48cf742fe1a5, 514117d536e347560d049cfe0c609632, 514ac0d73b8a1b73488ef5e2e55a75c3, 67e3617f8709d34f806f8e02badba8a5, 9000820d8153c24cd60d53001d3a97b6) and SHA256 ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7 (Magecart skimmer). Load into EDR blocklists and run retro-hunts across 90 days. Note: NetamLoader's in-memory .NET stages mean hash coverage is partial — pair with the behavioral detections below.
  • CVEs: CVE-2026-8467 (Convertr/Plausible vector), CVE-2026-109618 / CVE-2026-109619 (NetamLoader update-chain). Prioritize against internet-facing and government-build assets respectively.

Tooling: normalize IOCs to STIX/TAXII via your TIP (OpenCTI, MISP); push hashes to EDR (Defender, CrowdStrike), domains/IPs to firewall and DNS (via SOAR), and URLs to SWG. Validate hits against false-positive context — ntpsync.io subdomains may collide with legitimate NTP pooling in some environments.

Detection Engineering

YAML
---
title: NetamLoader AppDomainManager Injection via .NET Assembly Load
description: Detects .NET processes loading assemblies from non-standard paths combined with AppDomainManager configuration artifacts, consistent with NetamLoader's XAML/AppDomainManager injection chain targeting Asian government Windows 10 builds.
logsource:
    category: process_creation
    product: windows
 detection:
    selection_clr:
        Image|endswith:
            - '\PresentationHost.exe'
            - '\rundll32.exe'
            - '\Regsvcs.exe'
            - '\RegAsm.exe'
            - '\mshta.exe'
        CommandLine|contains:
            - '.xaml'
            - 'AppDomainManager'
            - 'appdomainmanager.config'
    selection_paths:
        CommandLine|contains:
            - '\Windows\SoftwareDistribution\'
            - '\WinSxS\'
            - '\Temp\'
            - '\AppData\Local\Temp\'
    condition: selection_clr and selection_paths
falsepositives:
    - Legitimate ClickOnce or XBAP application deployments
    - Enterprise .NET patching tooling
level: high
tags:
    - attack.defense_evasion
    - attack.t1218
    - attack.t1574
    - attack.t1059
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://securelist.com/netamloader/121676/
---
title: Outbound Connection to Known n0n Ransomware or NetamLoader C2 Infrastructure
description: Flags network connections to n0n ransomware staging/extortion IPs, NetamLoader C2 domain, and Magecart exfiltration endpoints from OTX pulse data.
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '198.13.158.143'
            - '217.18.55.185'
            - '45.132.114.241'
    selection_domain:
        DestinationHostname|contains:
            - 'openaigpt4v.com'
            - 'ntpsync.io'
            - '1x0.is'
            - 'ecomscan.com'
            - 'antiddos-protection.net'
            - 'deepveindrilling.com'
    condition: 1 of selection_*
falsepositives:
    - Threat intelligence enrichment lookups by SOC tooling
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.exfiltration
    - attack.t1041
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/29
---
title: Suspicious CAB Archive Dropped in Windows Update Directory
description: Detects creation of CAB files in Windows update staging directories by non-system processes, matching NetamLoader's supply-chain staging technique.
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Windows\SoftwareDistribution\Download\'
            - '\Windows\WinSxS\'
        TargetFilename|endswith: '.cab'
    filter_legit:
        Image|endswith:
            - '\TiWorker.exe'
            - '\TrustedInstaller.exe'
            - '\svchost.exe'
            - '\wuauclt.exe'
            - '\UsoClient.exe'
    condition: selection and not filter_legit
falsepositives:
    - Third-party patch management agents
    - SCCM/Intune content staging (verify process lineage)
level: high
tags:
    - attack.persistence
    - attack.t1574
    - attack.initial_access
    - attack.t1195
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/10/29
KQL — Microsoft Sentinel / Defender
// Security Arsenal — OTX Hunt: n0n C2 + NetamLoader + Magecart exfil
// Scope: last 30 days, network and process telemetry
let N0nIPs = dynamic(["198.13.158.143", "217.18.55.185", "45.132.114.241"]);
let BadDomains = dynamic(["openaigpt4v.com", "ecomscan.com", "antiddos-protection.net", "deepveindrilling.com", "1x0.is", "ntpsync.io"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (N0nIPs)
       or RemoteUrl has_any (BadDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
    | extend Hunt = "IOC-Match";
let NetamBehavior =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any ("AppDomainManager", ".xaml", "appdomainmanager.config")
       or (FileName in~ ("PresentationHost.exe", "RegAsm.exe", "Regsvcs.exe")
           and ProcessCommandLine has_any ("SoftwareDistribution", "WinSxS", "Temp"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
    | extend Hunt = "NetamLoader-Behavior";
union NetworkHits, NetamBehavior
| sort by TimeGenerated desc
PowerShell
# Security Arsenal — OTX IOC Hunt Script
# n0n Ransomware + NetamLoader + Magecart infrastructure sweep
# Run elevated. Output: CSV per host for SOAR ingestion.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. NetamLoader: rogue CAB files in Windows update directories ---
$updatePaths = @("$env:SystemRoot\SoftwareDistribution\Download", "$env:SystemRoot\WinSxS")
foreach ($p in $updatePaths) {
    Get-ChildItem -Path $p -Recurse -Filter *.cab -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash $_.FullName -Algorithm MD5).Hash
        $report += [PSCustomObject]@{
            Check = 'NetamLoader-CAB'; Path = $_.FullName; Hash = $hash
            Created = $_.CreationTime
            KnownBad = ($hash -in @('4f28622c5e60c01319bf48cf742fe1a5','514117d536e347560d049cfe0c609632','514ac0d73b8a1b73488ef5e2e55a75c3','67e3617f8709d34f806f8e02badba8a5','9000820d8153c24cd60d53001d3a97b6'))
        }
    }
}

# --- 2. NetamLoader: AppDomainManager injection artifacts in .NET configs ---
Get-ChildItem -Path "$env:SystemRoot\Microsoft.NET","$env:ProgramFiles","${env:ProgramFiles(x86)}" -Recurse -Include *.config -ErrorAction SilentlyContinue |
    Select-String -Pattern 'AppDomainManager' -List | ForEach-Object {
        $report += [PSCustomObject]@{ Check = 'AppDomainManager-Config'; Path = $_.Path; Hash = ''; Created = ''; KnownBad = $true }
    }

# --- 3. n0n: active/historical connections to staging IPs and beacon domain ---
$n0nIPs = @('198.13.158.143','217.18.55.185','45.132.114.241')
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $n0nIPs } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [PSCustomObject]@{ Check = 'n0n-C2-Connection'; Path = $proc.Path; Hash = ''; Created = ''; KnownBad = $true }
}
$dns = Get-DnsClientCache | Where-Object { $_.Entry -match 'ntpsync\.io|openaigpt4v\.com|1x0\.is|ecomscan\.com|antiddos-protection\.net|deepveindrilling\.com' }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{ Check = 'Malicious-DNS-Cache'; Path = $d.Entry; Hash = $d.Data; Created = ''; KnownBad = $true }
}

# --- 4. n0n: ransomware-style persistence (run keys, suspicious scheduled tasks) ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'Temp|AppData|SoftwareDistribution' } | ForEach-Object {
            $report += [PSCustomObject]@{ Check = 'Suspicious-RunKey'; Path = "$rk -> $($_.Name)"; Hash = $_.Value; Created = ''; KnownBad = 'Review' }
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'Temp|AppData' -and $_.TaskPath -notmatch 'Microsoft' } | ForEach-Object {
    $report += [PSCustomObject]@{ Check = 'Suspicious-SchedTask'; Path = $_.TaskName; Hash = $_.Actions.Execute; Created = ''; KnownBad = 'Review' }
}

$report | Export-Csv -Path ".\OTX_Hunt_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. Findings: $($report.Count). Review CSV for KnownBad=True entries first."

Response Priorities

Immediate (0–4 hours)

  • Block all three n0n IPs (198.13.158.143, 217.18.55.185, 45.132.114.241) at egress firewall and proxy; sinkhole openaigpt4v.com, 1x0.is, ecomscan.com, antiddos-protection.net, deepveindrilling.com, and wildcard-alert on *.ntpsync.io subdomains matching the observed pattern.
  • Push the six hash IOCs to EDR blocklists; initiate the KQL hunt and PowerShell sweep across all Windows endpoints — prioritize any assets running government/sector-specific OS builds.
  • If you operate ecommerce or process payments: audit all third-party scripts on checkout pages immediately; implement a DOM-level skimmer canary (synthetic checkout transaction monitoring).
  • Verify FortiGate SSL-VPN patch posture and disable VPN access for any account without MFA.

24 Hours

  • Credential verification: n0n uses credential stuffing as an initial access vector — force password resets for any account with VPN/SSO authentication from anomalous geographies in the past 60 days; check credentials against breach corpora.
  • For retail operations touching Brazilian customers: assume CPF + card data exposure if Convertr was in the payment path since 2026-10-24; initiate PCI incident procedures and card-brand notification thresholds.
  • Review Windows update pipeline integrity: validate CAB signatures in SoftwareDistribution and confirm WSUS/Intune channel integrity. Any unsigned or non-Microsoft-signed CAB is a sev-1 finding.
  • Retro-search 90 days of DNS/proxy logs for the six malicious domains — DNS cache hits on servers (non-browsing assets) are high-fidelity compromise signals.

1 Week

  • Architecture hardening — update chain: enforce signature verification on all update-directory writes; alert on any non-TrustedInstaller/TiWorker write to SoftwareDistribution or WinSxS (the Sigma rule above operationalizes this).
  • Edge access: migrate FortiGate SSL-VPN users to certificate-bound authentication or ZTNA; n0n's 23-victim spread demonstrates that VPN credential attacks scale catastrophically.
  • Third-party script governance: deploy Subresource Integrity (SRI) where feasible, Content Security Policy with connect-src restrictions (this would have blocked the 1x0.is WebSocket exfil), and continuous script-integrity monitoring on payment pages.
  • AI-service egress control: NetamLoader's use of openaigpt4v.com exploits permissive AI-service egress policies. Implement an allowlist of sanctioned AI endpoints and alert on AI-brand lookalike domains from non-browser processes.
  • Brief leadership on the AI-assisted ransomware trend: n0n's $7,000 LLM spend produced a multi-country extortion operation — adversary capability-per-dollar has fundamentally shifted, and signature-only defenses are now structurally insufficient.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-aptn0n-ransomwarenetamloadermagecart-skimmersupply-chain-attackai-assisted-extortion

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action