NKAbuse, notnullOSX & APT28 Roundcube Toolkit: Enterprise Credential Theft & Infostealer Swarm

title: Potential CVE-2026-39987 Marimo Exploitation and NKAbuse Payload
date: 2026/04/17
author: Security Arsenal
status: stable
description: Detects potential exploitation of marimo notebooks leading to suspicious Python child processes or blockchain related connections.
references:
    - https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface
tags:
    - attack.execution
    - attack.t1059.006
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\python.exe'
        ParentCommandLine|contains: 'marimo'
    selection_suspicious_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\bash.exe'
    selection_network:
        DestinationPort|startswith: 
            - '53' 
            - '443' 
            - '80'
        DestinationIp|contains: 
            - '160.30' 
            - '185.225' 
            - '111.90'
    condition: selection_parent and (selection_suspicious_child or selection_network)
falsepositives:
    - Legitimate developer usage of marimo launching shells
level: high

---

title: Suspicious Launcher_x64.exe DLL Sideloading (Direct-Sys Loader)
date: 2026/04/17
author: Security Arsenal
status: stable
description: Detects the execution pattern associated with Direct-Sys Loader where a signed Microsoft binary loads a suspicious DLL or spawns unexpected child processes.
references:
    - https://www.cyderes.com/howler-cell/direct-sys-loader-cgrabber-stealer-five-stage-malware-chain
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_loader:
        Image|endswith: '\Launcher_x64.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'rundll32.exe'
            - 'regsvr32.exe'
    selection_anomaly:
        Image|endswith: '\Launcher_x64.exe'
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection_loader and (selection_suspicious or selection_anomaly)
falsepositives:
    - Legitimate software installers using this specific launcher name (rare)
level: critical

---

title: macOS ClickFix Pattern and notnullOSX DMG Execution
date: 2026/04/17
author: Security Arsenal
status: stable
description: Detects the ClickFix social engineering pattern on macOS where curl downloads a payload and mounts a DMG, associated with notnullOSX distribution.
references:
    - https://moonlock.com/notorious-hacker-returns-notnullosx-stealer
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: macos
detection:
    selection_clickfix:
        Image|endswith: '/curl'
        CommandLine|contains: 'hdiutil attach'
    selection_dmg_mount:
        Image|endswith: '/hdiutil'
        CommandLine|contains: 'attach'
    selection_chain:
        ParentImage|endswith: '/bash'
        Image|endswith: '/bash'
        CommandLine|contains: '.dmg'
    condition: 1 of selection_*
falsepositives:
    - Legitimate admin script mounting disk images
level: medium

// Hunt for Typosquatting Domains and Suspicious Processes
let MaliciousDomains = pack_array("get-proton-vpn.com", "vpn-proton-setup.com", "newworld-helloworld.icu", "sinixproduction.com", "evasivestars.com", "zhblz.com");
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) or RemoteUrl has "onworks.net"
| join kind=inner (DeviceProcessEvents
| where FileName in~ ("powershell.exe", "cmd.exe", "python.exe", "Launcher_x64.exe")
) on DeviceId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by Timestamp desc

<#
.SYNOPSIS
    IOC Hunt Script for Infostealer Campaigns (NKAbuse, Direct-Sys, NWHStealer).
.DESCRIPTION
    Scans filesystem for suspicious binaries, checks hosts file for C2 domains,
    and checks for marimo specific python environments.
#>

$ErrorActionPreference = "SilentlyContinue"

# Indicators of Compromise (IOCs)
$IOC_Hashes = @(
    "1d36de06a6240919189cb46e0bcccc3c", 
    "bdcb5867f73beae89c3fce46ad5185be",
    "5cb3b902ae5993ae4e502f1c29cfb4e0",
    "50fcf93b14a6898347d1ca2c43e1b180"
)

$IOC_Domains = @(
    "get-proton-vpn.com",
    "vpn-proton-setup.com",
    "newworld-helloworld.icu",
    "zhblz.com",
    "sinixproduction.com"
)

$SuspiciousFiles = @("Launcher_x64.exe")

Write-Host "[+] Starting Hunt for Infostealer IOCs..." -ForegroundColor Cyan

# 1. Check for Suspicious Launcher Files
Write-Host "\n[*] Checking for Direct-Sys Loader artifacts..." -ForegroundColor Yellow
$PathsToSearch = @("C:\Users\", "C:\ProgramData\", "C:\Temp\")
foreach ($Path in $PathsToSearch) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $SuspiciousFiles -contains $_.Name } | 
        ForEach-Object {
            Write-Host "[!] FOUND: $($_.FullName)" -ForegroundColor Red
            $hash = Get-FileHash -Path $_.FullName -Algorithm MD5
            Write-Host "    MD5: $($hash.Hash)"
        }
    }
}

# 2. Check Hosts File for C2 Domains
Write-Host "\n[*] Checking Hosts file for malicious domains..." -ForegroundColor Yellow
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $IOC_Domains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] ALERT: Domain $Domain found in Hosts file." -ForegroundColor Red
        }
    }
}

# 3. Check for Marimo/NKAbuse Python Paths
Write-Host "\n[*] Checking for Marimo/Python exploitation traces..." -ForegroundColor Yellow
$PythonPaths = @("C:\Python*\", "$env:USERPROFILE\AppData\Local\Programs\Python\")
foreach ($PPath in $PythonPaths) {
    Get-ChildItem -Path $PPath -Recurse -Filter "*.py" -ErrorAction SilentlyContinue | 
    Select-String -Pattern "marimo|nkn|blockchain" | 
    ForEach-Object {
        Write-Host "[!] SUSPICIOUS PYTHON SCRIPT: $($_.Path)" -ForegroundColor Red
    }
}

Write-Host "\n[+] Hunt Complete." -ForegroundColor Cyan