Operation Endgame Aftermath, Woodgnat & JINX-0164: Multi-Vector Infostealer & AI Infrastructure Exploitation

---
title: Potential KimJongRAT Activity via GitHub and MeshAgent
id: 69d8e41c-2c9f-45a0-8b8d-9e9a1b2c3d4f
description: Detects potential KimJongRAT activity based on IOCs and GitHub distribution patterns observed by Kimsuky.
status: experimental
date: 2026/06/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6751a8b09d24b623981e52ca
tags:
    - attack.initial_access
    - attack.execution
logsource:
    category: network_connection
detection:
    selection_net:
        DestinationHostname|contains:
            - 'servequake.com'
            - 'corpsecs.com'
    selection_process:
        Image|endswith:
            - 'meshagent.exe'
            - 'meshsvc.exe'
        ParentImage|endswith:
            - 'powershell.exe'
            - 'cmd.exe'
    condition: 1 of selection*
falsepositives:
    - Legitimate use of MeshAgent in managed IT environments
level: high
---
title: Woodgnat Mistic Backdoor C2 Communication
id: 5f7b3d2a-1e4c-4b9f-8c7e-6d5f4a3b2c1d
description: Detects network connections to domains associated with the Woodgnat group and Mistic backdoor.
status: experimental
date: 2026/06/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/675059980d9b623981e529d3
tags:
    - attack.c2
    - attack.command_and_control
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'authorized-logins.net'
            - 'grande-luna.top'
            - 'human-check.top'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Langflow AI Pipeline Exploitation Attempt
id: 8a9b2c3d-4e5f-6789-0abc-1def23456789
description: Detects exploitation attempts against Langflow vulnerabilities (CVE-2026-55255) involving specific URI paths and source IPs.
status: experimental
date: 2026/06/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6755d66509d24b623981e52c5
tags:
    - attack.initial_access
    - attack.exploitation_for_client_execution
logsource:
    category: webserver
detection:
    selection_uri:
        c-uri|contains: '/slt'
    selection_src:
        c-ip:
            - '45.207.216.55'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative access
level: high


kql
// Hunt for JINX-0164 and Woodgnat Infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "driver-updater.net",
    "teamicrosoft.com",
    "authorized-logins.net",
    "overlapsnowbound.com",
    "servequake.com",
    "live.ong"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend ThreatContext = case(
    RemoteUrl has "driver-updater.net", "JINX-0164 Crypto Campaign",
    RemoteUrl has "authorized-logins.net", "Woodgnat Mistic C2",
    RemoteUrl has "servequake.com", "Kimsuky KimJongRAT",
    "Other Infostealer Infrastructure"
)


powershell
# IOC Hunt Script: Scan for File Hashes and Network Connections
# Run as Administrator

$TargetHashes = @(
    "ff8d2afd9d7f0a828592fee34ca55d1a3542f7ed", # Amadey/Stealc
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", # Mistic Backdoor
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", # AUDIOFIX/MINIRAT
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470"  # KimJongRAT
)

$SuspiciousDomains = @(
    "overlapsnowbound.com",
    "authorized-logins.net",
    "driver-updater.net",
    "servequake.com",
    "corpsecs.com"
)

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check Running Processes for Hashes
Write-Host "Checking process memory hashes..." -ForegroundColor Yellow
Get-Process | ForEach-Object {
    $proc = $_
    try {
        $path = $proc.Path
        if ($path -and (Test-Path $path)) {
            $hash = (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $hash) {
                Write-Host "[ALERT] Malicious process detected: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor Red
                Write-Host "  Path: $path"
                Write-Host "  Hash: $hash"
            }
        }
    } catch {}
}

# 2. Check DNS Cache / Connections for Domains
Write-Host "Checking active network connections for suspicious domains..." -ForegroundColor Yellow
Get-NetTCPConnection | ForEach-Object {
    $conn = $_
    if ($conn.State -eq 'Established') {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            if ($SuspiciousDomains | Where-Object { $remoteHost -like "*$_*" }) {
                $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
                Write-Host "[ALERT] Suspicious connection established by $($proc.ProcessName)" -ForegroundColor Red
                Write-Host "  Remote: $remoteHost ($($conn.RemoteAddress)):$($conn.RemotePort)"
            }
        } catch {}
    }
}

Write-Host "Hunt complete." -ForegroundColor Cyan