Operation STANDOFF + Offside Wallet Theft Factory: Raccoon/RedLine Stealer Ecosystem & Malicious Firefox Extension Campaign — OTX Detection Pack

---
title: Operation STANDOFF Stealer Loader Execution and C2 Indicators
id: 7c3a1f2e-9b41-4d2a-a5e8-standoff0001
status: experimental
description: Detects process execution and network behaviors associated with Operation STANDOFF commodity stealer/loader chains (SmokeLoader, Amadey, Raccoon, RedLine, Socelars, Glupteba) including known C2 domains and panel API paths.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
references:
    - https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'listincode.com'
            - 'wfsdragon.ru'
            - 'topniemannpickshop.cc'
            - 'all-mobile-pa1ments.com.mx'
            - 'buy-fantasy-gxmes.com.sg'
    selection_path:
        DestinationHostname|contains:
            - 'wfsdragon.ru'
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\powershell.exe'
            - '\mshta.exe'
    condition: selection_domain or selection_path
falsepositives:
    - Rare; homoglyph lure domains have no legitimate enterprise use
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1105
---
title: Suspicious Egress from Browser Processes to Supabase or Cloudflare Workers Exfiltration Endpoints
id: 8d4b2e3f-1c52-4e3b-b6f9-offside00002
status: experimental
description: Detects browser processes making outbound connections to Supabase projects or Cloudflare Workers domains, consistent with the Offside Wallet Theft Factory malicious Firefox extension exfiltration chain.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
references:
    - https://socket.dev/blog/firefox-crypto-wallet-theft
logsource:
    category: network_connection
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\firefox.exe'
    selection_exfil:
        DestinationHostname|endswith:
            - '.supabase.co'
            - '.workers.dev'
    selection_ioc:
        DestinationHostname|contains:
            - 'browser-app.com'
            - 'browsify.net'
            - 'gemachriverdale.org'
            - 'e-wl.com'
    filter_legit:
        DestinationHostname|contains:
            - 'mozilla.org'
            - 'firefox.com'
    condition: (selection_browser and selection_exfil and not filter_legit) or selection_ioc
falsepositives:
    - Legitimate extensions using Cloudflare Workers backends; baseline known-good extensions before enforcement
level: high
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.t1071.001
    - attack.t1176
---
title: Stealer Persistence via Run Key or Scheduled Task Followed by Print Spooler Exploitation (CVE-2021-34527)
id: 9e5c3f4a-2d63-5f4c-c7aa-standoff0003
status: experimental
description: Detects registry Run key persistence or scheduled task creation combined with suspicious Print Spooler (spoolsv.exe) child process activity, matching Operation STANDOFF post-infection privilege escalation behavior referencing PrintNightmare.
author: Security Arsenal Threat Intelligence
date: 2026/08/20
logsource:
    category: process_creation
    product: windows
detection:
    selection_spooler_child:
        ParentImage|endswith: '\spoolsv.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\net.exe'
            - '\whoami.exe'
    selection_lolbin_dll:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - '\Temp\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
    condition: selection_spooler_child or selection_lolbin_dll
falsepositives:
    - Legitimate print driver installation generating rundll32 activity; correlate with preceding stealer IOCs
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1547.001
    - attack.t1053.005

// OTX Hunt: Operation STANDOFF stealer C2 + Offside Wallet Theft Factory exfiltration
// Microsoft Sentinel / Defender — 14-day lookback
let StandoffDomains = dynamic(["listincode.com","www.listincode.com","wfsdragon.ru","topniemannpickshop.cc","all-mobile-pa1ments.com.mx","buy-fantasy-gxmes.com.sg"]);
let OffsideDomains = dynamic(["browser-app.com","browsify.net","gemachriverdale.org","e-wl.com"]);
let ExfilSuffixes = dynamic([".supabase.co",".workers.dev"]);
let StandoffHashes = dynamic(["08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f","4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb","26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7","252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (StandoffDomains) or RemoteUrl has_any (OffsideDomains)
       or RemoteUrl has "/api/setStats.php"
       or (InitiatingProcessFileName =~ "firefox.exe" and RemoteUrl has_any (ExfilSuffixes))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 in~ (StandoffHashes)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName =~ "spoolsv.exe"
      and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","net.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
)
| sort by TimeGenerated desc

# OTX IOC Hunt — Operation STANDOFF stealer persistence + Offside Wallet Theft Factory
# Run elevated on suspected endpoints. Outputs to C:\Temp\OTX_Hunt_<hostname>.txt

$out = "C:\Temp\OTX_Hunt_$env:COMPUTERNAME.txt"
"=== OTX HUNT :: $env:COMPUTERNAME :: $(Get-Date) ===" | Out-File $out

# 1. Run-key persistence entries (stealer persistence)
"`n[RUN KEYS]" | Out-File $out -Append
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        Get-ItemProperty $k | Select-Object * | Out-String | Out-File $out -Append
    }
}

# 2. Scheduled tasks pointing at user-writable paths (loader persistence)
"`n[SUSPICIOUS SCHEDULED TASKS]" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
    if ($actions -match 'AppData|Temp|ProgramData|Downloads') {
        "$($_.TaskName) :: $actions" | Out-File $out -Append
    }
}

# 3. Live network connections to campaign infrastructure
"`n[NETWORK IOC CHECK]" | Out-File $out -Append
$badHosts = @('listincode.com','wfsdragon.ru','topniemannpickshop.cc','all-mobile-pa1ments.com.mx','buy-fantasy-gxmes.com.sg','browser-app.com','browsify.net','gemachriverdale.org','e-wl.com')
foreach ($h in $badHosts) {
    try {
        $ips = (Resolve-DnsName $h -ErrorAction Stop).IPAddress
        foreach ($ip in $ips) {
            $conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $ip }
            if ($conns) { "ACTIVE CONNECTION to $h ($ip) :: PID $($conns.OwningProcess -join ',')" | Out-File $out -Append }
        }
    } catch {}
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 80,443 } |
    ForEach-Object { "$($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess) $((Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName)" } |
    Out-File $out -Append

# 4. Firefox extensions audit (Offside Wallet Theft Factory)
"`n[FIREFOX EXTENSIONS]" | Out-File $out -Append
$profiles = Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Directory -ErrorAction SilentlyContinue
foreach ($p in $profiles) {
    $extJson = Join-Path $p.FullName 'extensions.json'
    if (Test-Path $extJson) {
        $j = Get-Content $extJson -Raw | ConvertFrom-Json
        foreach ($a in $j.addons) { "$($a.id) :: $($a.defaultLocale.name) :: active=$($a.active)" | Out-File $out -Append }
    }
    Get-ChildItem (Join-Path $p.FullName 'extensions') -Filter *.xpi -ErrorAction SilentlyContinue |
        ForEach-Object { "XPI: $($_.FullName) SHA256=$((Get-FileHash $_.FullName -Algorithm SHA256).Hash)" | Out-File $out -Append }
}

# 5. Print Spooler exposure (CVE-2021-34527 / PrintNightmare post-exploitation path)
"`n[PRINT SPOOLER STATUS]" | Out-File $out -Append
$spooler = Get-Service spooler -ErrorAction SilentlyContinue
"Spooler service: $($spooler.Status)" | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PrintService/Admin'} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Out-String | Out-File $out -Append

# 6. Known campaign file hashes on disk
"`n[HASH SWEEP]" | Out-File $out -Append
$badHashes = @('08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f','4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb','26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7','252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435')
Get-ChildItem "$env:TEMP","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads" -Recurse -File -ErrorAction SilentlyContinue |
    ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h) { "MATCH: $($_.FullName) :: $h" | Out-File $out -Append }
    }

"`n=== HUNT COMPLETE ===" | Out-File $out -Append
Write-Host "Results written to $out"