Threat Summary

Recent OTX pulse data highlights an active, sophisticated cybercriminal operation identified as "Operation STANDOFF." This campaign is orchestrated by a Russian-speaking threat actor utilizing shared infrastructure to distribute a cocktail of commodity malware families. The attack chain is designed to maximize criminal revenue through a pay-per-install model, simultaneously enrolling victims into a proxy-botnet.

The campaign primarily delivers information stealers (Raccoon, RedLine, Socelars), loaders (SmokeLoader, Amadey), and a cryptocurrency miner (XMRig), alongside the modular Glupteba botnet. A key operational security (OpSec) technique observed is the use of GitHub redirects to obfuscate Command-and-Control (C2) communications, leveraging the legitimate reputation of GitHub to bypass initial network filters. C2 infrastructure is notably hosted on the Russian provider TimeWeb, featuring IPs such as 188.225.72.157 and 212.192.241.62.

Threat Actor / Malware Profile

Distribution Method

The campaign employs a pay-per-install (PPI) loader service. Initial access vectors likely involve phishing emails, malicious downloads, or exploit kits (indicated by the presence of CVE-2021-34527). The use of GitHub links serves as a delivery mechanism for payloads or as a redirector to the TimeWeb-hosted C2 servers.

Payload Behavior

Raccoon Stealer / RedLine: These infostealers harvest browser credentials, autocomplete data, cookies, and cryptocurrency wallet information from infected endpoints.
SmokeLoader / Amadey: These loaders serve as "downloaders," establishing persistence on the host and retrieving subsequent payloads (secondary stealers or miners) from the C2.
Glupteba: A modular botnet known for its versatility, capable of stealing data, mining cryptocurrency, and acting as a proxy botnet. It also uses the Bitcoin blockchain to update its C2 addresses, making takedowns difficult.
XMRig: A Monero cryptocurrency miner deployed to utilize victim CPU resources for profit.

C2 Communication

C2 traffic is routed through domains such as listincode.com and wfsdragon.ru, with the notable twist of GitHub redirects potentially used for dead-dropResolver (DDR) style communication or simply to mask the destination IP addresses hosted on TimeWeb (185.215.113.35).

Persistence & Anti-Analysis

Persistence: Malware like SmokeLoader and Glupteba typically establish persistence via scheduled tasks, registry run keys, or service installations.
Anti-Analysis: The campaign uses standard anti-VM and anti-sandbox techniques inherent in families like Glupteba and Raccoon to evade automated analysis.

IOC Analysis

The provided indicators of compromise (IOCs) reveal a focused set of network infrastructure:

IPv4s (e.g., 188.225.72.157, 212.192.241.62): These TimeWeb-hosted IPs likely serve as the primary C2 servers. SOC teams should block these at the perimeter and firewall level and hunt for historical outbound connections.
Domains (e.g., listincode.com, wfsdragon.ru): Used for C2 communication. These should be sinkholed or blocked via DNS filtering solutions.
CVE (CVE-2021-34527): This Windows Print Spooler vulnerability (PrintNightmare) suggests a potential initial access vector or lateral movement method. Patch management systems must verify compliance.

Operational Guidance: SOC teams should ingest these IOCs into their SIEM and EDR systems immediately. Given the proxy-botnet nature of Glupteba, look for anomalous outbound traffic patterns on non-standard ports from endpoints that do not typically act as proxies.

Detection Engineering

Sigma Rules

YAML

---
title: Potential Operation STANDOFF C2 Connection via GitHub Redirects
id: 5b8f9d12-3e45-4a89-b123-456789012345
description: Detects outbound connections to known Operation STANDOFF TimeWeb IPs or domains, potentially triggered via GitHub redirects.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61773873a31e647243b3f6b7/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|contains:
            - '188.225.72.157'
            - '185.215.113.35'
            - '212.192.241.62'
        DestinationHostname|contains:
            - 'listincode.com'
            - 'wfsdragon.ru'
    condition: selection
falsepositives:
    - Legitimate traffic to these specific IPs/domains (unlikely for generic enterprise)
level: high
---
title: Suspicious Process Execution - Common Stealer Loader Patterns
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects execution patterns often associated with SmokeLoader, Amadey, or Glupteba droppers (e.g., rundll32.exe, regsvr32.exe loading from unusual paths).
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61773873a31e647243b3f6b7/
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
            - '\\powershell.exe'
    selection_cli:
        CommandLine|contains:
            - 'javascript:'
            - 'URLMon'
            - '/i:http'
            - 'DownloadString'
    filter_legit:
        ParentImage|contains:
            - '\\Program Files'
            - '\\System32'
    condition: selection_img and selection_cli and not filter_legit
falsepositives:
    - Administrative scripts
level: medium
---
title: Operation STANDOFF - Glupteba Scheduled Task Persistence
id: c3d4e5f6-7890-12ab-34cd-567890abcdef0
description: Detects the creation of scheduled tasks often used by Glupteba for persistence, characterized by specific actions or naming conventions.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61773873a31e647243b3f6b7/
tags:
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4698
        TaskName|contains:
            - 'Update'
            - 'Driver'
        CommandLine|contains:
            - '/sc onlogon'
            - '/sc onstart'
            - 'powershell -enc'
    condition: selection
falsepositives:
    - Legitimate system updates or admin tasks
level: high

KQL (Microsoft Sentinel)

kql// Hunt for connections to Operation STANDOFF infrastructure DeviceNetworkEvents | where Timestamp > ago(7d) | where RemoteUrl has_any ("listincode.com", "wfsdragon.ru") or RemoteIP in ("188.225.72.157", "185.215.113.35", "212.192.241.62") | project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort

// Hunt for suspicious process execution patterns (Loaders/Stealers) DeviceProcessEvents | where Timestamp > ago(24h) | where FileName in~ ("rundll32.exe", "regsvr32.exe", "powershell.exe") | where ProcessCommandLine has_any ("javascript:", "/i:http", "DownloadString", "urlmon.dll") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName | summarize Count() by FileName, DeviceName

PowerShell Hunt Script

powershell# Operation STANDOFF IOC Hunt Script

Checks for network connections to malicious C2s and registry persistence.

$MaliciousIPs = @("188.225.72.157", "185.215.113.35", "212.192.241.62") $MaliciousDomains = @("listincode.com", "wfsdragon.ru")

Write-Host "[+] Checking for established connections to known STANDOFF C2 IPs..." -ForegroundColor Cyan $Connections = Get-NetTCPConnection | Where-Object { $MaliciousIPs -contains $_.RemoteAddress } if ($Connections) { Write-Host "[!] WARNING: Found active connections to malicious IPs:" -ForegroundColor Red $Connections | Format-Table -AutoSize } else { Write-Host "[-] No active connections found to malicious IPs." -ForegroundColor Green }

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan $DNSCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } if ($DNSCache) { Write-Host "[!] WARNING: Found DNS cache entries for malicious domains:" -ForegroundColor Red $DNSCache | Format-Table -AutoSize } else { Write-Host "[-] No DNS cache entries found for malicious domains." -ForegroundColor Green }

Write-Host "[+] Checking Run Registry Keys for suspicious persistence..." -ForegroundColor Cyan $RunKeys = @( "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" ) foreach ($Key in $RunKeys) { if (Test-Path $Key) { Get-Item $Key | Select-Object -ExpandProperty Property | ForEach-Object { $Value = (Get-ItemProperty -Path $Key -Name $).$ # Simple heuristic for suspicious paths (user profile or temp) if ($Value -match "C:\Users\.*\AppData" -or $Value -match "\Temp\") { Write-Host "[!] Suspicious Persistence Found: $Key - Name: $_ - Value: $Value" -ForegroundColor Yellow } } } }

Response Priorities

Immediate:
- Block all listed IP addresses and domains at the network perimeter and firewall.
- Initiate a hunt for the provided IOCs across endpoint telemetry (SIEM/EDR) to identify compromised hosts.
- Isolate any endpoints showing signs of connection to TimeWeb IPs or running rundll32.exe with suspicious arguments.
24 Hours:
- Conduct credential resets for accounts accessed from infected endpoints, focusing on privileged accounts (AD Admins) given the "active-directory-targeting" tag.
- Review Active Directory logs for anomalies or signs of lateral movement consistent with Glupteba or credential dumping tools.
1 Week:
- Verify patching for CVE-2021-34527 (PrintNightmare) across the environment.
- Implement stricter egress filtering and application control policies to prevent usage of GitHub as a redirector for non-development purposes.
- Review user awareness training regarding phishing and credential hygiene.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Operation STANDOFF: Multi-Vector Infostealer Campaign Leveraging GitHub Redirects