OP-512 China-Linked Espionage + UNC3753 Targeted Campaigns: GhostKit, PlugX, Cobalt Strike, BazarLoader, TrickBot - OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential OP-512 Web Shell Activity on IIS
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential web shell activity associated with OP-512 campaign targeting IIS servers
status: experimental
author: Security Arsenal
date: 2026/07/05
references:
    - https://reliaquest.com/blog/threat-spotlight-reliaquests-agentic-ai-uncovers-new-china-linked-cluster-op-512
tags:
    - attack.persistence
    - attack.webshell
    - attack.t1505.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140 or 5145
        ShareName|contains: 'wwwroot$'
    filter:
        SubjectUserName:
            - 'IUSR'
            - 'IIS_IUSRS'
            - 'SYSTEM'
            - 'NETWORK SERVICE'
    condition: selection and not filter
falsepositives:
    - Legitimate IIS administration
level: high
---
title: OP-512 C2 Infrastructure Communication
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
description: Detects potential communication with known OP-512 C2 infrastructure
status: experimental
author: Security Arsenal
date: 2026/07/05
references:
    - https://reliaquest.com/blog/threat-spotlight-reliaquests-agentic-ai-uncovers-new-china-linked-cluster-op-512
tags:
    - attack.command_and_control
    - attack.t1071.004
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp|contains:
            - '43.160.202.246'
            - '124.156.129.151'
            - '140.206.161.227'
        DestinationPort:
            - 8053
            - 443
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: UNC3753 Initial Access via Remote Support Tools
id: c3d4e5f6-7890-12ab-cdef-3456789012cd
description: Detects potential initial access by UNC3753 through remote support tools
status: experimental
author: Security Arsenal
date: 2026/07/05
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/targeted-campaign-us-law-firms
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\msra.exe'
            - '\TeamViewer.exe'
            - '\AnyDesk.exe'
            - '\ScreenConnect.exe'
        ParentImage|endswith:
            - '\explorer.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: selection
falsepositives:
    - Legitimate remote support activities
level: medium

// Hunt for connections to OP-512 C2 infrastructure
DeviceNetworkEvents
| where RemoteIP in ("43.160.202.246", "124.156.129.151", "140.206.161.227")
| or RemoteUrl in ("http://140.206.161.227:443", "http://43.160.202.246:8053")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

// Hunt for connections to UNC3753 domains
DeviceNetworkEvents
| where RemoteUrl in~ ("hcgos.com", "business-data-leaks.com", "lockbit.black", "itdesk.com")
| or RemoteDnsDomain in~ ("hcgos.com", "business-data-leaks.com", "lockbit.black", "itdesk.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteDnsDomain
| order by Timestamp desc

// Hunt for potential OP-512 web shell activity
SecurityEvent
| where EventID in (5140, 5145)
| where ShareName contains "wwwroot$"
| where SubjectUserName !in ("IUSR", "IIS_IUSRS", "SYSTEM", "NETWORK SERVICE")
| project Timestamp, Computer, SubjectUserName, ShareName, AccessMask
| order by Timestamp desc

// Hunt for UNC3753 malware execution
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("msra.exe", "TeamViewer.exe", "AnyDesk.exe", "ScreenConnect.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

# OP-512 & UNC3753 IOC Hunt Script
# Checks for network connections to known threat infrastructure

# Import necessary modules
Import-Module NetAdapter

# Check for connections to OP-512 C2 infrastructure
Write-Host "Checking for connections to OP-512 C2 infrastructure..."
$OP512_IPs = @("43.160.202.246", "124.156.129.151", "140.206.161.227")
$OP512_URLs = @("http://140.206.161.227:443", "http://43.160.202.246:8053")
$OP512_Domains = @("hcgos.com", "ashx.lhlsjcb.com")

# Check network connections
$networkConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
foreach ($connection in $networkConnections) {
    if ($OP512_IPs -contains $connection.RemoteAddress) {
        $process = Get-Process -Id $connection.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "ALERT: Connection to OP-512 IP $($connection.RemoteAddress):$($connection.RemotePort) detected!" -ForegroundColor Red
        Write-Host "Process: $($process.ProcessName) (PID: $($connection.OwningProcess))" -ForegroundColor Yellow
    }
}

# Check UNC3753 domains
$UNC3753_Domains = @("business-data-leaks.com", "lockbit.black", "itdesk.com")

# Check DNS cache
Write-Host "`nChecking DNS cache for threat domains..."
$dnsCache = Get-DnsClientCache | Where-Object {$_.Entry -in ($OP512_Domains + $UNC3753_Domains)}
foreach ($entry in $dnsCache) {
    Write-Host "ALERT: DNS entry for $($entry.Entry) found!" -ForegroundColor Red
    Write-Host "Data: $($entry.Data)" -ForegroundColor Yellow
}

# Check browser history (requires admin privileges)
Write-Host "`nChecking browser history for threat URLs..."
$chromeHistoryPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
if (Test-Path $chromeHistoryPath) {
    Copy-Item $chromeHistoryPath "$env:TEMP\chrome_history_temp" -Force
    $chromeHistory = Import-Csv "$env:TEMP\chrome_history_temp" -Delimiter "`0" -Header url, title, visit_count, typed_count, last_visit_time, last_visit_time_after_1970
    foreach ($entry in $chromeHistory) {
        foreach ($url in ($OP512_URLs + $OP512_Domains + $UNC3753_Domains)) {
            if ($entry.url -like "*$url*") {
                Write-Host "ALERT: Browser history contains entry for $url!" -ForegroundColor Red
                Write-Host "URL: $($entry.url)" -ForegroundColor Yellow
            }
        }
    }
    Remove-Item "$env:TEMP\chrome_history_temp" -Force
}

# Check for web shell characteristics on IIS servers
if (Get-Service W3SVC -ErrorAction SilentlyContinue) {
    Write-Host "`nSystem appears to be an IIS server. Checking for potential web shells..."
    $webRoots = @("C:\inetpub\wwwroot", "C:\inetpub\wwwroot\*", "D:\inetpub\wwwroot", "E:\inetpub\wwwroot")
    
    foreach ($path in $webRoots) {
        if (Test-Path $path) {
            $recentFiles = Get-ChildItem $path -Recurse -File | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)}
            
            foreach ($file in $recentFiles) {
                # Check for suspicious ASP.NET files
                if ($file.Extension -in @(".aspx", ".asmx", ".ashx", ".asp")) {
                    $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
                    if ($content) {
                        # Check for suspicious content patterns
                        $suspiciousPatterns = @("System.Diagnostics.Process.Start", "Runtime.getRuntime().exec", "eval(", "base64_decode", "Shell.Application")
                        foreach ($pattern in $suspiciousPatterns) {
                            if ($content -match $pattern) {
                                Write-Host "ALERT: Suspicious content pattern '$pattern' found in $($file.FullName)" -ForegroundColor Red
                                Write-Host "Last modified: $($file.LastWriteTime)" -ForegroundColor Yellow
                            }
                        }
                    }
                }
            }
        }
    }
}

# Check for BadPotato/SweetPotato/EfsPotato indicators
Write-Host "`nChecking for privilege escalation tool indicators..."
$potatoIndicators = @("C:\Windows\Temp\BadPotato.exe", "C:\Windows\Temp\SweetPotato.exe", "C:\Windows\Temp\EfsPotato.exe")
foreach ($indicator in $potatoIndicators) {
    if (Test-Path $indicator) {
        Write-Host "ALERT: Potential privilege escalation tool found at $indicator" -ForegroundColor Red
    }
}

Write-Host "`nIOC hunt complete. Review alerts and take appropriate action."