NIK C2, MadApe Phishing Kit & Star Blizzard Credential Theft Wave: OTX Pulse Analysis — Enterprise Detection Pack

Five live pulses from the AlienVault Open Threat Exchange converge on a single theme: credential theft at industrial scale, increasingly augmented by AI tooling and abuse of legitimate identity infrastructure.

The dominant pattern across this batch is not a single campaign but a shared tactical shift: adversaries are abandoning noisy password-harvesting pages in favor of token theft, legitimate authentication flow abuse, and AI-assisted post-compromise triage.

• NIK C2 represents the emergence of AI-native command-and-control: a Go-based Windows implant that streams keystrokes, dumps credentials, and pipes victim data through the OpenAI Chat Completions API for real-time analysis of stolen information. This collapses the time between initial compromise and actionable intelligence for the operator.
• MadApe is a previously undocumented phishing kit abusing Microsoft's legitimate Device Code authentication flow. Because the victim authenticates on Microsoft's real login page, no credential is ever captured on attacker infrastructure — traditional phishing detection and password-reset playbooks fail entirely.
• Star Blizzard (Callisto / FSB Centre 18) continues its espionage-driven credential theft against NATO governments, defense, NGOs, and academia, deploying EvilGinx adversary-in-the-middle tooling alongside a deep malware bench (SPICA, LOSTKEYS, NOROBOT, GHOSTBLADE).
• n0n ransomware demonstrates the monetization endpoint of stolen credentials: credential stuffing against FortiGate SSL-VPN appliances, followed by data exfiltration, backup destruction, and destructive extortion — with the operator's workspace revealing over $7,000 in paid LLM API usage, confirming AI-assisted attack development.
• PHP2Shell / kkkkevin777 shows credential reuse as a pivot mechanism: one compromised Japanese real estate company on shared hosting became nearly 20 victim sites and 16,061 stolen customer records.

The collective objective: acquire valid credentials and session tokens, weaponize them for espionage (Star Blizzard) or extortion (n0n, kkkkevin777), and use AI to accelerate exploitation of stolen data.

Threat Actor / Malware Profile

NIK C2 (AI-Enabled C2 Framework)

• Distribution: Windows implant, Go-compiled; delivered via social engineering and loader chains per Talos reporting.
• Payload behavior: Credential dumping, live keystroke streaming, screen-locking ransomware capability, AMSI bypass on execution.
• C2 communication: Dual-channel architecture — TLS-secured WebSockets as primary, HTTP fallback. Payloads encrypted with AES-256-GCM. Uniquely, victim data is forwarded to the OpenAI Chat Completions API, meaning outbound traffic to api.openai.com from non-developer endpoints is a high-fidelity signal.
• Anti-analysis: Go binary obfuscation, AMSI bypass routines, encrypted channel content that defeats passive payload inspection.

MadApe (Microsoft Device Code Phishing Kit)

• Distribution: Business-themed PDF lures leading through configurable redirect chains to fake document-sharing pages. Currently concentrated against Israeli targets, but the kit is portable.
• Payload behavior: No payload — the victim is instructed to enter a device code on Microsoft's genuine login page. The attacker captures the resulting OAuth token.
• Persistence: Stolen refresh tokens provide durable access surviving password resets.
• Detection implication: Over 565 associated domains in the pulse; the only reliable host-side signals are the redirect-chain domains and impossible-travel / anomalous token issuance in Entra ID logs.

Star Blizzard (Callisto, FSB Centre 18)

• Distribution: Long-con spear-phishing with relationship building, impersonation of colleagues and journalists; malicious documents exploiting CVE-2022-30190 (Follina), CVE-2023-36884, CVE-2023-38831 (WinRAR), CVE-2024-4947.
• Tooling: EvilGinx AiTM proxy for session token theft; SPICA backdoor; LOSTKEYS stealer; NOROBOT/YESROBOT/MAYBEROBOT loader family; BAITSWITCH/SIMPLEFIX downloaders; GHOSTBLADE, RedFlick, CosmicPulse.
• Targeting: Government, defense, NGOs, media, energy, academia across the US, UK, Ukraine, and NATO states.

n0n Ransomware

• Access vector: Credential stuffing against FortiGate SSL-VPN portals.
• Behavior: Data exfiltration, backup destruction, encryption, destructive extortion. 23+ confirmed victims across 14 countries and nine sectors.
• Notable: Exposed staging server contained the encryptor source, breach tooling, and an LLM coding-agent environment — direct evidence of AI-assisted ransomware development.

PHP2Shell (kkkkevin777)

• Vector: Web shell deployment on shared hosting via CVE-2026-109618 and CVE-2026-109619, then lateral movement via credential reuse across co-hosted tenants.
• Impact: 16,061 customer records from Japanese real estate and finance targets; staging infrastructure at 96.126.130.81.

IOC Analysis

The pulse set contains four indicator classes requiring distinct handling:

File hashes (SHA256) — 20+ NIK C2 implant hashes plus Star Blizzard tooling. Operationalize by pushing to EDR blocklists and retrohunting across DeviceFileEvents / Sysmon Event ID 1. Hashes rotate fast; treat as point-in-time evidence and pair with behavioral detection below.

IPv4 addresses — n0n C2/staging (198.13.158.143, 217.18.55.185, 45.132.114.241), PHP2Shell staging (96.126.130.81), Star Blizzard infrastructure (103.245.231.248). Block at egress firewall and web proxy; hunt NetFlow and DNS resolver logs for 90 days of history.

Domains/hostnames — 565 MadApe redirect-chain domains (sucdens.com, cepoffices.com, zakosta.info, etc.), Star Blizzard phishing domains (preentootmist.org, captchanom.top), and the DGA-style n0n beacon hostname. Block via DNS sinkhole; alert on any resolution — a single hit on a MadApe domain warrants immediate Entra ID token review for the associated user.

CVEs — Map Star Blizzard's exploited CVEs against your vulnerability scan data. Any unpatched WinRAR (CVE-2023-38831) or Office instance in a targeted vertical is an open door.

Tooling: decode and pivot through OTX pulses directly, enrich hashes via VirusTotal/MalwareBazaar, and track MadApe domain infrastructure via passive DNS (new domains are registered in clusters sharing registrars and TLS certificate patterns).

Detection Engineering

---
title: NIK C2 Implant - AI-Channel C2 Communication
id: 8f2a1b7c-3d4e-4f5a-9b6c-1a2b3c4d5e01
status: experimental
description: Detects non-browser processes establishing connections to the OpenAI API, consistent with NIK C2 implant exfiltrating victim data for AI-powered analysis. Combined with WebSocket-style long-lived TLS sessions this is a high-fidelity indicator.
author: Security Arsenal
references:
  - https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/
date: 2026/10/29
logsource:
  category: network_connection
  product: windows
  definition: sysmon
detection:
  selection_destination:
    DestinationHostname|contains:
      - 'api.openai.com'
  filter_legitimate:
    Image|endswith:
      - '\Code.exe'
      - '\cursor.exe'
      - '\Copilot.exe'
  condition: selection_destination and not filter_legitimate
falsepositives:
  - Developer workstations using AI coding assistants
  - Legitimate AI-integrated enterprise tooling
level: high
tags:
  - attack.exfiltration
  - attack.command_and_control
  - attack.t1071.001
---
title: Microsoft Device Code Flow Authentication Anomaly - MadApe Phishing
id: 7e1b9a3d-2c4f-4e5b-8a6d-2b3c4d5e6f02
status: experimental
description: Detects device code authentication grant usage, which is abused by the MadApe phishing kit to capture OAuth tokens without harvesting credentials on attacker pages. Correlate with sign-ins from unusual geographies or ASNs.
author: Security Arsenal
references:
  - https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/
date: 2026/10/29
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    authentication_protocol: 'deviceCode'
    properties.authenticationDetails.authenticationMethod: 'Device code'
  condition: selection
falsepositives:
  - Legitimate CLI authentication (Azure CLI, PowerShell) from IT staff
  - IoT and kiosk device enrollment
level: high
tags:
  - attack.initial_access
  - attack.credential_access
  - attack.t1566
  - attack.t1528
---
title: FortiGate SSL-VPN Credential Stuffing Followed by Backup Destruction - n0n Ransomware
id: 6d0c8b2a-1b3e-4d4a-7b5c-3c4d5e6f7003
status: experimental
description: Detects execution of volume shadow copy deletion and backup catalog destruction shortly after VPN authentication, matching the n0n ransomware destructive extortion playbook.
author: Security Arsenal
date: 2026/10/28
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
      - '\wmic.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'shadowcopy delete'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration (rare on endpoints)
level: critical
tags:
  - attack.impact
  - attack.t1490

// Security Arsenal - OTX Pulse Hunt: NIK C2, MadApe, n0n, Star Blizzard, PHP2Shell
// Scope: network indicators + behavioral signals for AI-channel C2 and credential abuse
let Lookback = 14d;
let PulseIPs = dynamic(["198.13.158.143", "217.18.55.185", "45.132.114.241", "96.126.130.81", "103.245.231.248"]);
let PulseDomains = dynamic(["sucdens.com", "cepoffices.com", "zakosta.info", "nsboards.com", "adastraerrans.com", "travestiilan.com", "nysndigital.com", "powerlivings.com", "preentootmist.org", "captchanom.top"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteIP in (PulseIPs)
       or RemoteUrl has_any (PulseDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend HitType = "PulseIOC";
let AIChannelC2 =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has "api.openai.com"
    | where InitiatingProcessFileName !in~ ("Code.exe", "cursor.exe", "msedge.exe", "chrome.exe", "firefox.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
    | extend HitType = "NIK-C2-AI-Channel";
let BackupDestruction =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "delete catalog", "recoveryenabled no", "shadowcopy delete")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
    | extend HitType = "n0n-BackupDestruction";
union NetworkHits, AIChannelC2, BackupDestruction
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (NIK C2 / MadApe / Star Blizzard / n0n)
# Run elevated on endpoints or deploy via RMM/Intune remediation script
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Known-malicious file hashes from NIK C2 & Star Blizzard pulses
$badHashes = @(
    'ae38f1181c9dd0db7224d6023e335eb2cdabb0f441906d14ffba8602b7abca3c',
    '6583eb22ca554e749b647d68ae76f7279a8dc538196ebde1412669357a027de5',
    '30817712277bba54e4cb8640f4005aad35f5172f88cf046aea545d029e12ccba',
    '1fee4cd8d3560e6c60ba50451860adf6e705f26fd3fe1c1ccc058f4e8b13073a',
    'bf83345ca66bdc4bd45ade608a06361d18927dd80351e9a1d8cbe8eda5d78402',
    '99573a79f393299049216237d0d23761d67f6a8507a7a0cfe17cb30837f68f00',
    '5d25efba2119f52d08214a590fedb45a5c9fe5e2850fd87e7bca24c92745e6d1',
    '2a01056369cc691f5bed6bd2654930a81d1bc240a568a0d5b209aceef3b5c9c9',
    '87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48'
)
$scanPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads", "$env:ProgramData")
foreach ($path in $scanPaths) {
    Get-ChildItem -Path $path -Recurse -File -Include *.exe,*.dll,*.ps1,*.bat,*.lnk -ErrorAction SilentlyContinue |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($badHashes -contains $h) {
                $report += [pscustomobject]@{Type='MaliciousHash'; Path=$_.FullName; Detail=$h}
            }
        }
}

# 2. Suspicious outbound connections to pulse IPs / OpenAI API from unexpected processes
$badIPs = @('198.13.158.143','217.18.55.185','45.132.114.241','96.126.130.81','103.245.231.248')
Get-NetTCPConnection -State Established | ForEach-Object {
    if ($badIPs -contains $_.RemoteAddress) {
        $proc = Get-Process -Id $_.OwningProcess
        $report += [pscustomobject]@{Type='C2-Connection'; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess)"}
    }
}
$dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -match 'api.openai.com|sucdens.com|cepoffices.com|zakosta.info|nsboards.com|preentootmist.org|captchanom.top' }
foreach ($d in $dnsCache) {
    $report += [pscustomobject]@{Type='SuspiciousDNS'; Path='DNSCache'; Detail="$($d.Entry) -> $($d.Data)"}
}

# 3. Persistence artifacts used by Go implants & loaders (Run keys, scheduled tasks)
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|ProgramData' -and $_.Value -match '\.exe|\.ps1|rundll32|powershell' } |
            ForEach-Object { $report += [pscustomobject]@{Type='RunKey'; Path=$key; Detail="$($_.Name)=$($_.Value)"} }
    }
}
Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike '\Microsoft\*' -and
    ($_.Actions.Execute -match 'powershell|cmd|rundll32|wscript') -and
    ($_.Actions.Arguments -match '-enc|-e |-w hidden|DownloadString|IEX')
} | ForEach-Object {
    $report += [pscustomobject]@{Type='SuspiciousTask'; Path=$_.TaskName; Detail="$($_.Actions.Execute) $($_.Actions.Arguments)"}
}

# 4. Evidence of shadow copy deletion (n0n ransomware behavior)
$shadows = vssadmin list shadows 2>$null
if (-not $shadows -or $shadows -notmatch 'Shadow Copy') {
    $report += [pscustomobject]@{Type='ShadowCopyMissing'; Path='VSS'; Detail='No shadow copies present - possible n0n destruction'}
}

if ($report.Count -gt 0) {
    Write-Output "=== OTX PULSE HUNT: $($report.Count) FINDINGS ==="
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "$env:TEMP\otx_pulse_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Output 'No pulse indicators found on this host.'
}

Response Priorities

Immediate (0–4 hours)

• Push all pulse IPs and the 565 MadApe domains to egress firewall, web proxy, and DNS sinkhole blocklists; alert (don't just block) on MadApe domains so each hit triggers an identity investigation.
• Deploy the Sigma rules and run the KQL hunt across a 14-day lookback; any api.openai.com connection from a non-browser, non-IDE process is treated as an active NIK C2 infection until disproven.
• Add the NIK C2 and Star Blizzard SHA256 hashes to EDR blocklists and initiate a retrohunt.
• Verify shadow copies exist on file servers and critical endpoints; alert on any vssadmin delete execution.

24 Hours (identity-focused — credential theft is the core of every pulse)

• Audit Entra ID sign-in logs for deviceCode grant flows; for any match, revoke all refresh tokens for the user, force re-authentication, and review mailbox rules and OAuth consent grants created in the same window.
• For any user whose host resolved a MadApe or Star Blizzard domain: revoke sessions, reset credentials, and enroll in phishing-resistant MFA (FIDO2) — stolen tokens bypass SMS and app-based MFA.
• Audit FortiGate SSL-VPN logs for authentication bursts (credential stuffing) from the n0n IPs; force password resets for any account with anomalous VPN logins and disable local accounts lacking MFA.
• Confirm AMSI is enabled and tamper protection is on across endpoints (NIK C2 ships AMSI bypass).

1 Week (architecture hardening)

• Restrict OAuth device code flow via Entra ID Conditional Access authentication strengths — block device code grant for all users except documented break-glass/IoT scenarios.
• Enforce phishing-resistant MFA (FIDO2/passkeys) for VPN, email, and administrative access; eliminate SMS/OTP which EvilGinx-style AiTM proxies defeat.
• Patch the Star Blizzard exploitation set: CVE-2022-30190, CVE-2023-36884, CVE-2023-38831, CVE-2024-4947 — prioritize mail-facing and end-user systems.
• Segment shared hosting and web infrastructure; audit for PHP2Shell web shells (CVE-2026-109618 / CVE-2026-109619) and enforce unique per-tenant credentials to break the reuse-pivot pattern.
• Implement egress filtering on api.openai.com and similar LLM endpoints restricted to approved service accounts and developer VLANs.
• Deploy immutable, offline backups (air-gap or WORM storage) as a direct counter to n0n's backup-destruction playbook.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub