Operation Master (masterblack/AdaptixC2), PHP2Shell RCE & Firefox Wallet-Impersonation Campaign: OTX Pulse Analysis — Enterprise Detection Pack

---
title: AdaptixC2 Operation Master - xp_cmdshell Database Exfiltration
id: 8f3a1c2e-7b41-4d9a-a2f6-3e5c9d1b0001
status: experimental
description: Detects enabling and execution of xp_cmdshell on MSSQL, used in Operation Master for database theft and command execution following SQL injection.
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
  - https://socradar.io/blog/operation-master-intrusion-monetization-pipeline
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
  selection_img:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_cli:
    CommandLine|contains:
      - 'xp_cmdshell'
      - 'sp_configure'
  condition: selection_parent and (selection_img or selection_cli)
falsepositives:
  - Legitimate DBA maintenance scripts executed interactively
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1005
---
title: Malicious Firefox Extension C2 - bonto.io Crypto Wallet Exfiltration
id: 8f3a1c2e-7b41-4d9a-a2f6-3e5c9d1b0002
status: experimental
description: Detects Firefox processes communicating with bonto.io subdomains used to exfiltrate stolen cryptocurrency seed phrases and private keys.
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
  - https://socket.dev/blog/firefox-wallet-impersonators
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|endswith: '.bonto.io'
  filter_legit:
    QueryName: 'bonto.io'
  condition: selection and not filter_legit
falsepositives:
  - Unlikely; bonto.io subdomains in this campaign have no legitimate enterprise use
level: critical
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1071.001
---
title: PHP2Shell Exploitation - PHP Process Spawning Shell (CVE-2026-109618/9)
id: 8f3a1c2e-7b41-4d9a-a2f6-3e5c9d1b0003
status: experimental
description: Detects php-cgi/php-fpm or web server processes spawning shells or downloaders, consistent with pre-application RCE via session.upload_progress use-after-free exploitation.
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
  - https://akatsukilegion.com/post.php?slug=php2shell-cve-2026-109618-9-havoc-unc-actors-leveraging-public-exploit-code-against-public-business-and-educational-infrastructure
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-cgi'
      - '/php-fpm'
      - '/php'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legacy PHP applications invoking shell via exec()/system() for image processing or backups
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190

// Security Arsenal — Operation Master / PHP2Shell / bonto.io multi-campaign hunt
// Coverage: C2 egress, PHP exploit child processes, SQLi xp_cmdshell, DNS tunneling
let Lookback = 14d;
let MalDns = dynamic(["phantom.bonto.io","jupiter.bonto.io","bitget.bonto.io","the-trust.org.uk","bloodmoonstudios.net","thunder.godofthunder.st"]);
let MalIPs = dynamic(["41.223.30.7","206.188.197.105"]);
let NetHits =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (MalDns) or RemoteIP in~ (MalIPs)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend Hunt = "C2/Exfil Network Hit";
let ProcHits =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where (InitiatingProcessFileName in~ ("php-cgi.exe","php-fpm","php.exe","httpd.exe","apache2","nginx.exe")
             and FileName in~ ("cmd.exe","powershell.exe","sh","bash","curl","wget"))
        or ProcessCommandLine has_any ("xp_cmdshell","sp_configure")
        or ProcessCommandLine has_any ("session.upload_progress","multipart/form-data")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend Hunt = "Exploit/SQLi Process Artifact";
let DnsTunnel =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback) and RemotePort == 53
    | where InitiatingProcessFileName !in~ ("svchost.exe","dns.exe","systemd-resolved")
    | summarize QueryCount = count() by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h)
    | where QueryCount > 500
    | extend Hunt = "Possible DNS Tunneling (high-volume anomalous resolver)";
union NetHits, ProcHits, DnsTunnel
| sort by Timestamp desc

# Security Arsenal — Multi-Campaign IOC & Artifact Hunt (Run as Admin, domain-wide via GPO/Intune/EDR)
$report = @()
$malDomains = @("phantom.bonto.io","jupiter.bonto.io","bitget.bonto.io","the-trust.org.uk","bloodmoonstudios.net","thunder.godofthunder.st")
$malIPs     = @("41.223.30.7","206.188.197.105")
$malHash    = "311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9"

Write-Host "[1/6] DNS cache sweep for exfil/C2 domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Entry; $malDomains | Where-Object { $d -like "*$_*" } }
if ($dns) { $report += "DNS HIT: $($dns | Out-String)" }

Write-Host "[2/6] Active & logged connections to malicious IPs..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $malIPs -contains $_.RemoteAddress }
if ($conns) { $report += "NETCONN HIT: $($conns | Select-Object LocalPort,RemoteAddress,State,OwningProcess | Out-String)" }

Write-Host "[3/6] Firefox extension sweep (wallet impersonators / homoglyphs)..." -ForegroundColor Cyan
Get-ChildItem "C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\extensions" -ErrorAction SilentlyContinue | ForEach-Object {
    Get-ChildItem $_.FullName -Filter *.xpi -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($h -eq $malHash -or $_.Name -match 'phantom|jupiter|bitget') {
            $report += "EXT HIT: $($_.FullName) SHA256=$h"
        }
    }
}

Write-Host "[4/6] Webshell & AdaptixC2 staging artifact check..." -ForegroundColor Cyan
$suspectPaths = @("C:\inetpub\wwwroot","C:\xampp\htdocs","C:\ProgramData\Microsoft\Crypto","$env:TEMP")
foreach ($p in $suspectPaths) {
    Get-ChildItem $p -Recurse -Include *.php,*.aspx,*.jsp,*.exe -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-21) } |
        ForEach-Object { $report += "RECENT WEBROOT/STAGING FILE: $($_.FullName) ($($_.LastWriteTime))" }
}

Write-Host "[5/6] MSSQL xp_cmdshell enablement check (registry)..." -ForegroundColor Cyan
$sqlKeys = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server" -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.Property -match 'xp_cmdshell' }
if ($sqlKeys) { $report += "SQL REG REVIEW: $($sqlKeys | Out-String)" }

Write-Host "[6/6] Persistence sweep — suspicious scheduled tasks & run keys (30d)..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'powershell|cmd|wscript|mshta|curl' -and $_.Date -gt (Get-Date).AddDays(-30)
} | ForEach-Object { $report += "TASK REVIEW: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

if ($report.Count -gt 0) {
    $report | Out-File "$env:TEMP\arsenal_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
    Write-Host "[!] FINDINGS — review report in $env:TEMP" -ForegroundColor Red
    $report | ForEach-Object { Write-Host $_ -ForegroundColor Yellow }
} else {
    Write-Host "[+] No campaign artifacts found on this host." -ForegroundColor Green
}