Operation RapidRust (APT36) + Mirage2FA AiTM Phishing Kit: Rust-Based Backdoors and M365 Session Theft — OTX Detection Pack

---
title: RUSTYSHADE Backdoor - GitHub Repository C2 Communication
id: 7e2a1c4d-rapidrust-0001-ghc2-detect001
status: experimental
description: Detects suspicious processes making outbound connections to GitHub API/content endpoints consistent with RUSTYSHADE's use of private GitHub repositories for AES-256-GCM encrypted C2 tasking (APT36 Operation RapidRust).
author: Security Arsenal Threat Intel
date: 2026/09/18
references:
  - https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'api.github.com'
      - 'raw.githubusercontent.com'
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_known:
    User|contains: 'githubactions'
  condition: selection_domain and selection_process and not filter_known
falsepositives:
  - Developer workstations using scripting tools against GitHub API
  - GitHub Actions runners
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102.002
---
title: RUSTYMOVE - USB-Based Lateral Movement Artifact Execution
id: 7e2a1c4d-rapidrust-0002-usb-lateralmove
status: experimental
description: Detects execution of binaries or scripts directly from removable media, consistent with RUSTYMOVE USB propagation used by APT36 to breach segmented/air-gapped defense networks.
author: Security Arsenal Threat Intel
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ':\\'
    Image|startswith:
      - 'D:'
      - 'E:'
      - 'F:'
      - 'G:'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.lnk'
      - '.ps1'
      - '.bat'
      - '.dll'
  condition: selection and selection_ext
falsepositives:
  - Legitimate portable applications run from USB by IT staff
level: medium
tags:
  - attack.lateral_movement
  - attack.t1091
  - attack.initial_access
  - attack.t1200
---
title: Mirage2FA - HTML Smuggling Dropper Execution Followed by Browser Network Activity
id: 9b3d2f1a-mirage2fa-0001-htmlsmuggle-aitm
status: experimental
description: Detects HTML smuggling delivery pattern - browser or email client writing HTML/JS payload followed by rundll32/mshta execution and connections to known Mirage2FA phishing relay TLDs associated with M365 session theft.
author: Security Arsenal Threat Intel
date: 2026/09/18
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\OUTLOOK.EXE'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  selection_cli:
    CommandLine|contains:
      - '.html'
      - '.hta'
      - 'javascript:'
      - 'base64'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Rare legitimate enterprise HTA applications
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1027.006
  - attack.credential_access
  - attack.t1557

// Mirage2FA AiTM Phishing Infrastructure + RapidRust GitHub C2 Hunt
// Microsoft Sentinel / M365 Defender Advanced Hunting

let MirageDomains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","office.pcvgtech.store","ver.verpox.shop","cementslabconstruction.com","adp.pslcertlive.site","ans.rsxbenefits.com","ari.vslbertlive.info"]);
let Lookback = 30d;

// Part 1: Users who resolved or connected to Mirage2FA phishing relay infrastructure
let PhishHits =
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (MirageDomains) or RemoteUrl endswith ".verpox.shop" or RemoteUrl endswith ".pslcertlive.site" or RemoteUrl endswith ".vslbertlive.info" or RemoteUrl endswith ".rsxbenefits.com"
| project PhishTime=TimeGenerated, DeviceName, AccountName=InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName;

// Part 2: Suspicious GitHub API access from non-developer processes (RUSTYSHADE C2)
let GitHubC2 =
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl in ("api.github.com","raw.githubusercontent.com") or RemoteIP in ("140.82.112.0/20")
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","wscript.exe","mshta.exe","rundll32.exe")
| project GHC2Time=TimeGenerated, DeviceName, GHAccount=InitiatingProcessAccountName, GHProcess=InitiatingProcessFileName, GHRemoteUrl=RemoteUrl;

// Part 3: Session hijack corroboration - sign-ins from anomalous ASN/user-agent for users in PhishHits
PhishHits
| join kind=leftouter (
    AADSignInEventsBeta
    | where TimeGenerated > ago(Lookback)
    | where RiskLevelDuringSignIn > 0 or IsFirstPartyApp == false
) on $left.AccountName == $right.AccountUpn
| project PhishTime, DeviceName, AccountName, RemoteUrl, RemoteIP, SignInTime=TimeGenerated1, IPAddress, Application, UserAgent
| summarize arg_min(PhishTime, *) by AccountName, RemoteUrl
;
GitHubC2

# Security Arsenal - RapidRust / Mirage2FA Endpoint Hunt Script
# Run via EDR live response or PS remoting across the fleet.
# Checks: persistence artifacts, USB execution traces, phishing domain DNS cache, file hashes.

$report = @()

# 1) Known RapidRust sample hashes (OTX pulse, 2026-09-17)
$badHashes = @(
  "40a75f87f1e52c33df9ca733aaf8ebbb",
  "aade06ec611d69f1553035f22356ccf4",
  "ae77f1834ccde53258bc27a779102af2",
  "f16f507a8ed515663a4f07050cd97a74"
)

# 2) Mirage2FA phishing infrastructure
$phishDomains = @("galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info")

Write-Host "[*] Checking persistence: Run keys..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Value -match "powershell|pwsh|rundll32|AppData|Temp" -and $_.Name -notmatch "^PS"
      } | ForEach-Object {
        $report += [pscustomobject]@{Check="RunKey"; Finding="$($key): $($_.Name) = $($_.Value)"; Host=$env:COMPUTERNAME}
      }
    }
  }
}

Write-Host "[*] Checking persistence: Scheduled tasks spawning interpreters..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
  $actions = ($_.Actions | Out-String)
  if ($actions -match "powershell|wscript|mshta" -and $_.TaskPath -notmatch "Microsoft") {
    $report += [pscustomobject]@{Check="ScheduledTask"; Finding="$($_.TaskPath)$($_.TaskName) -> $actions"; Host=$env:COMPUTERNAME}
  }
}

Write-Host "[*] Checking USB execution artifacts (RUSTYMOVE - USBStor + mounted devices)..." -ForegroundColor Cyan
if (Test-Path "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR") {
  Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR" -Recurse -ErrorAction SilentlyContinue |
    Select-Object -First 50 | ForEach-Object {
      $report += [pscustomobject]@{Check="USBDevice"; Finding=$_.PSChildName; Host=$env:COMPUTERNAME}
    }
}

Write-Host "[*] Checking DNS cache for Mirage2FA phishing domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $phishDomains) {
  $hits = $dns | Where-Object { $_.Entry -match [regex]::Escape($d) }
  foreach ($h in $hits) {
    $report += [pscustomobject]@{Check="DNSCache-PhishHit"; Finding="$($h.Entry) -> $($h.Data) [CREDENTIAL RESET REQUIRED]"; Host=$env:COMPUTERNAME}
  }
}

Write-Host "[*] Hash sweep: common staging dirs for RapidRust samples..." -ForegroundColor Cyan
$scanPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\ProgramData")
foreach ($p in $scanPaths) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue -Include *.exe,*.dll,*.ps1 |
    Where-Object { $_.Length -lt 30MB } | ForEach-Object {
      $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
      if ($badHashes -contains $md5.ToLower()) {
        $report += [pscustomobject]@{Check="MaliciousHash"; Finding="RAPIDRUST SAMPLE: $($_.FullName) [$md5]"; Host=$env:COMPUTERNAME}
      }
    }
}

Write-Host "[*] Checking active connections to GitHub API from scripts (RUSTYSHADE C2)..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -eq 443 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match "powershell|pwsh|wscript|mshta|rundll32") {
      $report += [pscustomobject]@{Check="ScriptNetConn"; Finding="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):443"; Host=$env:COMPUTERNAME}
    }
  }

Write-Host "`n===== HUNT RESULTS ($($report.Count) findings) =====" -ForegroundColor Yellow
$report | Format-Table -AutoSize | Out-String -Width 300
$report | Export-Csv ".\rapidrust_mirage2fa_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation