Operation Endgame & SmartApeSG: SocGholish Takedown, Okendo Supply Chain Attack, and FortiBleed Credential Harvesting — Intel Brief

---
title: Potential SocGholish Fake Browser Update Execution
id: b3c9f7e1-6d8f-4a9e-b5c0-1a2b3c4d5e6f
status: experimental
description: Detects execution of JScript files spawned by web browsers, a common tactic of SocGholish fake browser updates.
references:
    - https://www.infoblox.com/blog/threat-intelligence/hot-take-operation-endgame-vs-socgholish/
author: Security Arsenal
date: 2026/06/23
tags:
    - attack.defense_evasion
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\brave.exe'
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains: '.js'
    condition: selection
falsepositives:
    - Legitimate web-based tools using local scripts
level: high
---
title: Connection to SmartApeSG Malicious C2 Infrastructure
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects network connections to known malicious domains used in the Okendo Reviews supply chain attack.
references:
    - https://www.zscaler.com/blogs/security-research/smartapesg-launches-okendo-reviews-supply-chain-attack
author: Security Arsenal
date: 2026/06/23
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'wigetticks.com'
            - 'wizzleticks.com'
    condition: selection
falsepositives:
    - None
level: critical
---
title: FortiBleed Infrastructure Connection
id: 11223344-5566-7788-99aa-bbccddeeff00
status: experimental
description: Detects outbound connections to IP addresses identified in the FortiBleed credential harvesting campaign.
references:
    - https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind
author: Security Arsenal
date: 2026/06/23
tags:
    - attack.initial_access
    - attack.t1078
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|in:
            - '85.11.187.8'
            - '175.155.64.221'
            - '185.229.26.83'
            - '198.53.64.194'
            - '213.169.49.142'
            - '38.117.87.37'
            - '85.11.187.28'
    condition: selection
falsepositives:
    - Unlikely
level: critical


kql
// Hunt for SocGholish and Infostealer Domains/Hostnames
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    "trademark.iglesiaelarca.com", 
    "content.garretttrails.org",
    "promo.summat10n.org",
    "billing.roofnrack.us",
    "devel.asurans.com",
    "storehouse.beautysupplysalonllc.com",
    "samples.addisgraphix.com",
    "api-app.uppercrafteroom.com",
    "platform.exathomeswebuyarizona.com",
    "js-new.newtoyourgame.com",
    "comples.biz",
    "dafkov.shop",
    "ciuzdaw.shop",
    "ablackb.shop",
    "cloxaa.shop"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| summarize count() by RemoteUrl, DeviceName;

// Hunt for FortiBleed IP Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in~ ("85.11.187.8", "175.155.64.221", "185.229.26.83", "198.53.64.194", "213.169.49.142", "38.117.87.37", "85.11.187.28")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort;

// Hunt for Infostealer File Hashes (from Pulse 3)
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in~ ("46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c") or 
          MD5 in~ ("0d1f6685b4e284f92ef25c0f9358bcdc") or
          SHA1 in~ ("7d5c1d672d6e4bef1a7ca4ca9849db74e8690213")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5;


powershell
# IOC Hunt Script for SocGholish, SmartApeSG, and FortiBleed
# Run as Administrator

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check DNS Resolution for Malicious Domains (SocGholish & Infostealers)
$domains = @(
    "trademark.iglesiaelarca.com", "content.garretttrails.org", "promo.summat10n.org",
    "billing.roofnrack.us", "devel.asurans.com", "storehouse.beautysupplysalonllc.com",
    "samples.addisgraphix.com", "api-app.uppercrafteroom.com", "platform.exathomeswebuyarizona.com",
    "js-new.newtoyourgame.com", "comples.biz", "dafkov.shop", "ciuzdaw.shop",
    "ablackb.shop", "cloxaa.shop", "api.wiggettcks.com", "api.wizzleticks.com"
)

Write-Host "`n[+] Checking DNS resolution for malicious domains..." -ForegroundColor Yellow
$foundDomains = @()
foreach ($domain in $domains) {
    try {
        $result = Resolve-DnsName -Name $domain -ErrorAction Stop
        if ($result) {
            Write-Host "RESOLVED: $domain -> $($result.IPAddress)" -ForegroundColor Red
            $foundDomains += $domain
        }
    } catch {
        # Domain not resolving - expected for blocked/IOCs
    }
}

# 2. Scan for Malicious File Hashes (Infostealers)
$maliciousHashes = @{
    "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c" = "SHA256"
    "0d1f6685b4e284f92ef25c0f9358bcdc" = "MD5"
    "7d5c1d672d6e4bef1a7ca4ca9849db74e8690213" = "SHA1"
}

Write-Host "`n[+] Scanning common download directories for malicious file hashes..." -ForegroundColor Yellow
$paths = @("$env:USERPROFILE\Downloads", "$env:PUBLIC\Downloads", "C:\Temp")
$foundFiles = @()

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            foreach ($hash in $maliciousHashes.Keys) {
                $algo = $maliciousHashes[$hash]
                try {
                    $fileHash = (Get-FileHash -Path $_.FullName -Algorithm $algo -ErrorAction Stop).Hash.ToLower()
                    if ($fileHash -eq $hash.ToLower()) {
                        Write-Host "MATCH FOUND: $($_.FullName) ($algo)" -ForegroundColor Red
                        $foundFiles += $_.FullName
                    }
                } catch {
                    # Error reading file (locked or in use)
                }
            }
        }
    }
}

# 3. Check for Network Connections to FortiBleed IPs
$fortiBleedIPs = @("85.11.187.8", "175.155.64.221", "185.229.26.83", "198.53.64.194", "213.169.49.142", "38.117.87.37", "85.11.187.28")
Write-Host "`n[+] Checking active connections for FortiBleed IPs..." -ForegroundColor Yellow
$activeConnections = Get-NetTCPConnection | Where-Object { $fortiBleedIPs -contains $_.RemoteAddress }
if ($activeConnections) {
    $activeConnections | ForEach-Object {
        $process = Get-Process -Id $_.OwningProcess
        Write-Host "CONNECTION DETECTED: IP $($_.RemoteAddress) PID $($_.OwningProcess) ($($process.ProcessName))" -ForegroundColor Red
    }
} else {
    Write-Host "No active connections to FortiBleed infrastructure found." -ForegroundColor Green
}

if ($foundDomains.Count -eq 0 -and $foundFiles.Count -eq 0 -and $activeConnections.Count -eq 0) {
    Write-Host "`n[+] No immediate IOCs found on this host." -ForegroundColor Green
} else {
    Write-Host "`n[!] ALERT: IOC artifacts detected. Investigate immediately." -ForegroundColor Magenta
}