Operation AI Bait & Crypto MaaS: Vidar, SilabRAT, and Needle Campaign Analysis — OTX Pulse Intelligence

title: Potential Vidar Stealer Download via PowerShell
id: 91a2b3c4-5d6e-7f8g-9h0i-1j2k3l4m5n6o
description: Detects PowerShell commands downloading payloads from domains associated with Vidar Stealer distribution campaigns (TikTok/Social Engineering vectors).
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658a2b7c5c2b6176655d6e7
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_dl:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
    selection_iocs:
        CommandLine|contains:
            - 'msget.run'
            - 'd4ug.site'
            - 'brokeapt.com'
    condition: all of selection_*
falsepositives:
    - Legitimate administration scripts using these specific domains (unlikely)
level: high
---
title: SilabRAT C2 Network Connection
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
description: Detects outbound network connections to known SilabRAT infrastructure IP addresses.
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658a2b7c5c2b6176655d6e8
tags:
    - attack.c2
    - attack.t1071.001
logsource:
    product: windows
    category: network_connection
detection:
    selection:
        DestinationIp:
            - '91.199.163.124'
    condition: selection
falsepositives:
    - Legitimate traffic to this IP (unlikely, hosted on specific infrastructure)
level: critical
---
title: Suspicious Python Child Process Execution
id: b2c3d4e5-f6a7-8901-2345-678901bcdefg
description: Detects suspicious child processes spawned by Python, potentially indicating execution of malicious PyPI packages like Hades or Miasma.
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658a2b7c5c2b6176655d6e9
tags:
    - attack.execution
    - attack.t1204
techniques:
    - id: T1204
      name: User Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\python.exe'
            - '\python3.exe'
    selection_suspicious_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\bash.exe'
            - '\whoami.exe'
            - '\systeminfo.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate developer tools invoking system shells
level: medium

// Hunt for connections to known malicious domains and IPs
DeviceNetworkEvents
| where RemoteUrl in ("brokeapt.com", "msget.run", "d4ug.site", "pan.rongtv.xyz") 
   or RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend AlertContext = pack("Action", "Network connection to known C2/Distribution domain")

// Hunt for PowerShell processes associated with the Vidar TikTok campaign
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where ProcessVersionInfoOriginalFileName =~ "powershell.exe" or ProcessVersionInfoOriginalFileName =~ "pwsh.exe"
| where ProcessCommandLine has "msget.run" or ProcessCommandLine has "d4ug.site" or ProcessCommandLine has "IEX"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend AlertContext = pack("Action", "Suspicious PowerShell execution with IOC")

# IOC Hunt Script for SilabRAT and Vidar Indicators
# Requires Administrative Privileges

$MaliciousDomains = @(
    "brokeapt.com",
    "msget.run",
    "d4ug.site",
    "pan.rongtv.xyz",
    "pan.ssffaa19.xyz"
)

$MaliciousIP = "91.199.163.124"

Write-Host "[+] Hunting for active network connections to SilabRAT C2 ($MaliciousIP)..." -ForegroundColor Cyan
$netConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
$processes = Get-Process -IncludeUserName

foreach ($conn in $netConnections) {
    if ($conn.RemoteAddress -eq $MaliciousIP) {
        $proc = $processes | Where-Object { $_.Id -eq $conn.OwningProcess }
        Write-Host "[!] ALERT: Connection to $MaliciousIP found. PID: $($conn.OwningProcess), Process: $($proc.ProcessName), User: $($proc.UserName)" -ForegroundColor Red
    }
}

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $MaliciousDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($hits) {
        Write-Host "[!] ALERT: DNS resolution found for $domain" -ForegroundColor Red
        $hits | Format-Table Entry, Data, TimeToLive
    }
}

Write-Host "[+] Hunt complete. Review alerts for potential infection."


---