Operation STANDOFF: GitHub Redirect C2 & Multi-Loader Campaign (Raccoon, RedLine, Glupteba)

---
title: Potential GitHub Redirect C2 Activity
id: 4e8a3c12-5f9d-4a1e-8b2c-9f3d4e5a6b7c
description: Detects suspicious processes interacting with GitHub URLs indicative of C2 redirection or payload staging as seen in Operation STANDOFF.
author: Security Arsenal
date: 2026/07/22
references:
    - https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/
status: stable
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'github.com'
            - 'raw.githubusercontent.com'
        Initiated: 'true'
    filter_legit_dev:
        Image|contains:
            - 'git.exe'
            - 'visual studio'
            - 'node.exe'
            - 'python.exe'
        ParentImage|contains:
            - 'explorer.exe'
            - 'cmd.exe'
    condition: selection and not filter_legit_dev
falsepositives:
    - Legitimate developer tools using git
level: high
tags:
    - attack.command_and_control
    - attack.t1102
---
title: SmokeLoader Persistence via Registry Run Keys
id: b7d6e5f1-2a3c-4b8d-9e0f-1a2b3c4d5e6f
description: Detects persistence mechanism often used by SmokeLoader and similar loaders via Registry Run keys.
author: Security Arsenal
date: 2026/07/22
status: stable
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Windows\CurrentVersion\Run'
        Details|contains:
            - '/C' # Command execution switch
            - 'powershell'
            - 'regsvr32'
    condition: selection
falsepositives:
    - Legitimate software installation
level: medium
tags:
    - attack.persistence
    - attack.t1547.001
---
title: Proxy Botnet Network Activity (Operation STANDOFF)
id: c9d8e7f6-5a4b-3c2d-1e0f-9a8b7c6d5e4f
description: Detects network connections to known TimeWeb infrastructure associated with Operation STANDOFF proxy botnet.
author: Security Arsenal
date: 2026/07/22
status: stable
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '188.225.72.157'
            - '185.215.113.35'
            - '212.192.241.62'
    selection_domain:
        DestinationHostname:
            - 'listincode.com'
            - 'wfsdragon.ru'
            - 'topniemannpickshop.cc'
    condition: 1 of selection*
falsepositives:
    - Low
level: critical
tags:
    - attack.command_and_control
    - attack.t1071


kql
// Hunt for DNS resolutions to Operation STANDOFF domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("listincode.com", "wfsdragon.ru", "topniemannpickshop.cc")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend AlertDetail = "Operation STANDOFF C2 Detection"

// Hunt for processes connecting to TimeWeb IP ranges
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("188.225.72.157", "185.215.113.35", "212.192.241.62")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort


powershell
# Operation STANDOFF IOC Hunt Script
# Checks for network connections and registry persistence

Write-Host "Scanning for Operation STANDOFF Indicators..." -ForegroundColor Yellow

$IOCs = @(
    "188.225.72.157",
    "185.215.113.35",
    "212.192.241.62"
)

$Domains = @(
    "listincode.com",
    "wfsdragon.ru",
    "topniemannpickshop.cc"
)

# Check Active Network Connections
$activeConnections = Get-NetTCPConnection -State Established
foreach ($ip in $IOCs) {
    $found = $activeConnections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($found) {
        Write-Host "[ALERT] Active connection detected to malicious IP: $ip" -ForegroundColor Red
        $found | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
    }
}

# Check DNS Cache (Requires Admin)
try {
    $dnsCache = Get-DnsClientCache
    foreach ($dom in $Domains) {
        $foundDNS = $dnsCache | Where-Object { $_.Entry -like "*$dom*" }
        if ($foundDNS) {
            Write-Host "[ALERT] DNS Cache entry found for domain: $dom" -ForegroundColor Red
            $foundDNS | Select-Object Entry, Data, TimeToLive
        }
    }
} catch {
    Write-Host "Skipping DNS Cache check (Admin privileges required)." -ForegroundColor Gray
}

# Check Run Keys for Suspicious Persistence
$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
)

Write-Host "Checking Registry Run Keys for suspicious loader activity..." -ForegroundColor Cyan
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | Select-Object -ExpandProperty Property | ForEach-Object {
            $val = Get-ItemProperty -Path $key -Name $_
            # Heuristic: Check for obscure paths or /C flag usage
            if ($val.$_ -match "powershell" -or $val.$_ -match "cmd /c" -or $val.$_ -match "\.tmp") {
                Write-Host "[SUSPICIOUS] Persistence found in $key : $_ = $($val.$_)" -ForegroundColor Yellow
            }
        }
    }
}