Operation MASTER, MR ROBOT MaaS, and Lzveil Infostealers: OTX Pulse Analysis — Enterprise Detection Pack

---
title: AdaptixC2 DNS Tunneling - Operation MASTER
id: 9e2a5c8e-7b3a-4f1d-9c2e-8a5b6d7e8f9a
status: experimental
description: Detects DNS tunneling patterns associated with AdaptixC2 framework used in Operation MASTER intrusions
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
    - https://socradar.io/blog/operation-master-intrusion-monetization-pipeline
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'adaptix'
            - 'c2.'
            - 'beacon.'
    filter:
        query|endswith:
            - '.microsoft.com'
            - '.google.com'
            - '.cloudflare.com'
    condition: selection and not filter
falsepositives:
    - Legitimate DNS over HTTPS traffic
level: high
tags:
    - attack.command_and_control
    - attack.t1071.004
---
title: Infostealer DLL Side-Loading via python37.dll
id: 7a1b3c9e-2f4d-4e5a-8b6c-9d1e2f3a4b5c
status: experimental
description: Detects DLL side-loading of python37.dll or POWRPROF.dll used by Lzveil, Vidar, and DarkCloud infostealers
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
    - https://asec.ahnlab.com/en/96183/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
        CommandLine|contains:
            - 'python37.dll'
            - 'POWRPROF.dll'
    condition: selection
falsepositives:
    - Legitimate Python installations (rare in enterprise server contexts)
level: high
tags:
    - attack.defense_evasion
    - attack.t1218
    - attack.t1574.002
---
title: MR ROBOT Android Banking Trojan - Firebase Exfiltration
id: 3c4d5e6f-7a8b-9c1d-2e3f-4a5b6c7d8e9f
status: experimental
description: Detects network communication to Firebase domains characteristic of MR ROBOT Android banking trojan exfiltration
author: Security Arsenal Threat Intel
date: 2026/10/28
references:
    - https://www.cloudsek.com/blog/inside-mr-robot-malware-as-a-service-targeting-indian-bank-customers
logsource:
    category: network_connection
    product: android
detection:
    selection:
        DestinationHostname|contains:
            - 'firebaseio.com'
            - 'firebasedatabase.app'
        ProcessName|contains:
            - 'bank'
            - 'financial'
    condition: selection
falsepositives:
    - Legitimate banking applications using Firebase
level: medium
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.t1071.001

// Hunt for Operation MASTER GlobalProtect Exploitation and AdaptixC2 Activity
let SuspiciousProcesses = dynamic(["rundll32.exe", "regsvr32.exe", "powershell.exe", "cmd.exe"]);
let C2Patterns = dynamic(["adaptix", "beacon", "dns-tunnel"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemoteUrl has_any (C2Patterns) or RemoteIP in ("8b8e44431aff7fcf38f67ac30d4c63250e51117861635a8510ea1c897df49488", "ccd0bb059c9da0afb433effebc3c9ed76751569f5abcd1b34d7fc3dab87fd74b") // MR ROBOT IOCs as IP placeholders
    | where InitiatingProcessFileName has_any (SuspiciousProcesses)
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort),
    (DeviceProcessEvents
    | where FileName has_any (SuspiciousProcesses)
    | where ProcessCommandLine contains "GlobalProtect" or ProcessCommandLine contains "CVE-2026-0257"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256),
    (SecurityEvent
    | where EventID == 4688
    | where CommandLine contains "python37.dll" or CommandLine contains "POWRPROF.dll"
    | project TimeGenerated, Computer, NewProcessName, CommandLine, ParentProcessName)
| extend IOC_Type = case(
    RemoteUrl contains "bonto.io", "Cryptocurrency Theft C2",
    RemoteUrl contains "lastingonlineexperiences.de", "Phishing Infrastructure",
    ProcessCommandLine contains "python37.dll", "Infostealer Side-Loading",
    "Unknown"
)
| summarize count() by DeviceName, IOC_Type, bin(Timestamp, 1h)
| order by count_ desc

# Security Arsenal - OTX Pulse IOC Hunt Script
# Checks for Operation MASTER, MR ROBOT, and Infostealer artifacts

$ErrorActionPreference = "SilentlyContinue"
$Report = @()

# Check for Infostealer Registry Persistence (Run Keys)
$RegPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Path in $RegPaths) {
    $Items = Get-ItemProperty -Path $Path
    foreach ($Item in $Items.PSObject.Properties) {
        if ($Item.Value -match "python37.dll|POWRPROF.dll|Mediafire|crack|keygen") {
            $Report += [PSCustomObject]@{
                Type = "Registry Persistence"
                Location = "$Path\$($Item.Name)"
                Value = $Item.Value
                Risk = "High"
            }
        }
    }
}

# Check for DLL Side-Loading Artifacts
$SuspiciousDLLs = @("python37.dll", "POWRPROF.dll")
$SearchPaths = @("C:\Users\Public", "C:\Temp", "C:\ProgramData", $env:TEMP)

foreach ($SearchPath in $SearchPaths) {
    foreach ($DLL in $SuspiciousDLLs) {
        $Found = Get-ChildItem -Path $SearchPath -Filter $DLL -Recurse -ErrorAction SilentlyContinue
        if ($Found) {
            $Report += [PSCustomObject]@{
                Type = "Suspicious DLL"
                Location = $Found.FullName
                Value = "Potential side-loading artifact"
                Risk = "Medium"
            }
        }
    }
}

# Check for Network Connections to C2 Infrastructure
$MaliciousDomains = @("phantom.bonto.io", "jupiter.bonto.io", "bitget.bonto.io", "nbpn.lastingonlineexperiences.de", "slotpastimaxwin50jt.online")

$Netstat = netstat -ano | Select-String "ESTABLISHED"
foreach ($Line in $Netstat) {
    $Parts = $Line -split '\s+' | Where-Object { $_ -ne "" }
    if ($Parts.Count -ge 3) {
        $RemoteAddr = $Parts[2]
        foreach ($Domain in $MaliciousDomains) {
            try {
                $Resolved = [System.Net.Dns]::GetHostAddresses($Domain) | Select-Object -ExpandProperty IPAddressToString
                if ($RemoteAddr -match $Resolved) {
                    $Report += [PSCustomObject]@{
                        Type = "C2 Connection"
                        Location = "Active Connection"
                        Value = "$Domain ($RemoteAddr)"
                        Risk = "Critical"
                    }
                }
            } catch { continue }
        }
    }
}

# Check for GlobalProtect Artifacts (Operation MASTER)
$GPPaths = @(
    "${env:ProgramFiles}\Palo Alto Networks\GlobalProtect",
    "${env:ProgramFiles(x86)}\Palo Alto Networks\GlobalProtect"
)

foreach ($GPPath in $GPPaths) {
    if (Test-Path $GPPath) {
        $ConfigFiles = Get-ChildItem -Path $GPPath -Filter "*.xml" -Recurse
        foreach ($Config in $ConfigFiles) {
            $Content = Get-Content $Config.FullName -Raw
            if ($Content -match "CVE-2026-0257|AdaptixC2|masterblack") {
                $Report += [PSCustomObject]@{
                    Type = "GlobalProtect Compromise"
                    Location = $Config.FullName
                    Value = "Suspicious configuration modification"
                    Risk = "Critical"
                }
            }
        }
    }
}

# Check for Firefox Extension Persistence (Wallet Impersonators)
$FirefoxProfiles = "${env:APPDATA}\Mozilla\Firefox\Profiles"
if (Test-Path $FirefoxProfiles) {
    $Extensions = Get-ChildItem -Path $FirefoxProfiles -Filter "extensions.json" -Recurse
    foreach ($Ext in $Extensions) {
        $Json = Get-Content $Ext.FullName -Raw | ConvertFrom-Json
        foreach ($Addon in $Json.addons) {
            if ($Addon.defaultLocale.name -match "Phantom|Jupiter|Bitget" -and $Addon.id -notmatch "@mozilla") {
                $Report += [PSCustomObject]@{
                    Type = "Malicious Extension"
                    Location = $Addon.id
                    Value = "Potential wallet impersonator"
                    Risk = "High"
                }
            }
        }
    }
}

# Output Report
if ($Report.Count -gt 0) {
    Write-Host "=== SECURITY ARSENAL IOC HUNT RESULTS ===" -ForegroundColor Red
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path "OTX_Hunt_Results_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "No IOCs detected. System appears clean." -ForegroundColor Green
}