---
title: Potential NWHStealer Fake VPN Installation
id: 9c8e1d2a-3f4b-4c5d-9e6f-1a2b3c4d5e6f
description: Detects execution of binaries from paths associated with fake Proton VPN installers or suspicious hardware utilities referenced in NWHStealer campaigns.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660f1a2b3c4d5e6f
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\Installer.exe'
            - '\Setup.exe'
        Image|endswith:
            - '\vpn-proton-setup.exe'
            - '\hardware-visualizer.exe'
        CommandLine|contains:
            - '/silent'
            - '/verysilent'
    condition: selection
falsepositives:
    - Legitimate VPN software installation
level: high
---
title: macOS notnullOSX Suspicious DMG Mount and Execution
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects the mounting of DMG files followed by execution of unsigned binaries, a pattern associated with the notnullOSX campaign targeting crypto wallets.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660f1a2b3c4d5e6f
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
    product: macos
detection:
    selection_mount:
        Image|endswith: '/hdiutil'
        CommandLine|contains: 'attach'
    selection_exec:
        Image|endswith:
            - '.app/Contents/MacOS/'
            - '.app/Contents/MacOS/applet'
        Signed: 'false'
    timeframe: 30s
    condition: selection_mount | selection_exec
falsepositives:
    - Installation of legitimate unsigned developer tools
level: high
---
title: APT28 Roundcube Webshell Activity
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects suspicious process execution patterns often associated with APT28 Roundcube exploitation, specifically web server processes spawning shells or Python interpreters.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660f1a2b3c4d5e6f
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/apache2'
            - '/httpd'
            - '/nginx'
    selection_child:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/python3'
            - '/python'
        CommandLine|contains:
            - 'curl'
            - 'wget'
            - 'base64'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative web scripts
level: critical


kql
// Hunt for network connections to known C2 infrastructure and fake VPN domains
// Covers IPs from NKAbuse, notnullOSX, and NWHStealer
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteIP in ("111.90.145.139", "160.30.128.96", "185.225.17.176", "38.147.173.172", "83.217.209.88")
    or RemoteUrl has any ("get-proton-vpn.com", "vpn-proton-setup.com", "newworld-helloworld.icu", "coockie.pro", "sinixproduction.com", "zhblz.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend IoC_Type = iff(RemoteIP in ("111.90.145.139", "160.30.128.96", "185.225.17.176", "38.147.173.172", "83.217.209.88"), "IP", "Domain")


powershell
# IOC Hunt Script - NWHStealer & CGrabber Components
# Checks for specific file hashes and suspicious process execution patterns

$TargetHashes = @( 
    "5cb3b902ae5993ae4e502f1c29cfb4e0", # MD5 NWHStealer
    "50fcf93b14a6898347d1ca2c43e1b180", # MD5 Direct-Sys Loader
    "2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3", # SHA256 NWHStealer
    "e97cb6cbcf2583fe4d8dcabd70d3f67f6cc977fc9a8cbb42f8a2284efe24a1e3"  # SHA256 NWHStealer
)

$SuspiciousProcesses = @("vpn-proton-setup", "Launcher_x64")

Write-Host "[+] Starting IOC Hunt for NWHStealer / Direct-Sys Loader..." -ForegroundColor Cyan

# 1. Check for running suspicious processes
Write-Host "[+] Checking for suspicious process names..." -ForegroundColor Yellow
Get-Process | Where-Object { $SuspiciousProcesses -like "*$($_.ProcessName)*" } | Select-Object ProcessName, Id, Path

# 2. Scan C:\ for specific file hashes (Recursive scan, limited to common executable paths for performance)
Write-Host "[+] Scanning user directories and ProgramData for file hashes..." -ForegroundColor Yellow
$PathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Program Files\", "C:\Temp\")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue -Include @("*.exe", "*.dll", "*.bin") | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] ALERT: Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 3. Check DNS Cache for malicious domains
Write-Host "[+] Checking DNS Cache for fake VPN/C2 domains..." -ForegroundColor Yellow
$Domains = @("get-proton-vpn.com", "vpn-proton-setup.com", "newworld-helloworld.icu", "coockie.pro")
Get-DnsClientCache | Where-Object { $Domains -contains $_.Entry } | Select-Object Entry, Data, TimeToLive

Write-Host "[+] Hunt Complete." -ForegroundColor Green


# Response Priorities

**Immediate**
*   **Block Indicators:** Immediately block all listed IPs and Domains at the firewall and proxy level.
*   **Hunt Artifacts:** Execute the provided PowerShell script across endpoints to identify active NWHStealer or Direct-Sys infections.
*   **Quarantine:** Isolate devices returning positive hits for the file hashes or C2 connections.

**24 Hours**
*   **Credential Audit:** Force password resets and invalidate session tokens for users who may have accessed the fake VPN sites or whose devices are flagged for infostealer activity.
*   **Identity Verification:** Review logs for `Roundcube` webmail access anomalies (specifically login times and locations) for government sector clients.
*   **macOS Check:** Deploy a script to macOS endpoints to scan for the `notnullOSX` DMG mount artifacts and the specific SHA256 hashes provided.

**1 Week**
*   **Architecture Hardening:** Patch CVE-2026-39987 (marimo platform) immediately. Restrict access to HuggingFace Spaces and GitHub raw user content to vetted developer accounts.
*   **Policy Review:** Update acceptable use policies to prohibit the installation of unauthorized VPN software and gaming mods on corporate endpoints.
*   **Webmail Security:** Implement Web Application Firewall (WAF) rules to block XSS and CSS injection attempts characteristic of the APT28 "SpyPress" toolkit.