Packagist Supply-Chain iOS Spyware Chain (CVE-2025-31277 / CVE-2025-43529): FunNULL-Linked Crypto Seed Theft — OTX Pulse Analysis

---
title: Outbound Connection to FunNULL-Linked Crypto Theft Infrastructure
id: 7a3f1c2e-91b4-4d2a-8e5f-20260901a001
status: experimental
description: Detects DNS resolution or network connections to known FunNULL-linked domains and bare-IP C2 used by the Packagist iOS spyware campaign for crypto seed exfiltration.
author: Security Arsenal Threat Intel
date: 2026/09/01
references:
    - https://socket.dev/blog/packagist-themes-ios-spyware
logsource:
    category: dns
product: windows
detection:
    selection_domain:
        QueryName|contains:
            - 'funnull01.vip'
            - 'xemphimlau.com'
            - 'cre-ads.com'
            - 'ue8im.com'
    condition: selection_domain
falsepositives:
    - Threat intelligence validation scans
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Bare IP HTTP Connection on Non-Standard Port - FunNULL Redirect Kit Pattern
id: 7a3f1c2e-91b4-4d2a-8e5f-20260901a002
status: experimental
description: Detects HTTP connections to bare IPv4 addresses on non-standard high ports with /vip*.html URI patterns consistent with FunNULL redirect and C2 kits observed in the Packagist spyware campaign.
author: Security Arsenal Threat Intel
date: 2026/09/01
references:
    - https://socket.dev/blog/packagist-themes-ios-spyware
logsource:
    category: proxy
product: webserver
detection:
    selection_ip:
        c-ip|re: '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$'
    selection_port:
        cs-port:
            - '4466'
            - '8443'
            - '9443'
    selection_uri:
        cs-uri-stem|re: '\/vip\d+\.html'
    filter_known:
        c-ip:
            - '127.0.0.1'
    condition: selection_ip and selection_port and selection_uri and not filter_known
falsepositives:
    - Internal load balancer health checks using bare IPs
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1571
---
title: Composer Install of Suspicious Packagist Theme Package
id: 7a3f1c2e-91b4-4d2a-8e5f-20260901a003
status: experimental
description: Detects composer install/require executions pulling theme packages from suspicious vendor namespaces, indicating potential supply-chain compromise of web properties via malicious Packagist packages.
author: Security Arsenal Threat Intel
date: 2026/09/01
references:
    - https://socket.dev/blog/packagist-themes-ios-spyware
logsource:
    category: process_creation
product: linux
detection:
    selection_img:
        Image|endswith:
            - '/composer'
            - '/composer.phar'
    selection_cmd:
        CommandLine|contains:
            - 'install'
            - 'require'
            - 'update'
    selection_pkg:
        CommandLine|contains:
            - 'theme'
    condition: selection_img and selection_cmd and selection_pkg
falsepositives:
    - Legitimate theme package installations by web developers - validate package names against the published IOC namespace list
level: medium
tags:
    - attack.initial_access
    - attack.t1195.001
    - attack.t1195.002

// Sentinel Hunt: FunNULL-linked Packagist iOS Spyware C2 + Redirect Chain
// Hunts network connections and DNS to campaign IOCs, plus bare-IP high-port beaconing
let CampaignIOCs = dynamic(["funnull01.vip","xemphimlau.com","cre-ads.com","im.ue8im.com","ue8im.com"]);
let C2IP = "23.225.52.67";
let Lookback = 14d;
let DnsHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (CampaignIOCs) or RemoteIP == C2IP
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
              RemoteUrl, RemoteIP, RemotePort, ActionType
    | extend Detection = "IOC Match";
let BareIPBeacon = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemotePort in (4466, 8443, 9443)
    | where isempty(RemoteUrl)  // bare IP, no hostname
    | where ActionType == "ConnectionSuccess"
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
              RemoteUrl, RemoteIP, RemotePort, ActionType
    | extend Detection = "Bare-IP High-Port Beacon";
let ComposerPull = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName =~ "composer" or FileName =~ "composer.phar"
    | where ProcessCommandLine has_any ("install", "require", "update")
      and ProcessCommandLine has "theme"
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend Detection = "Suspicious Composer Theme Install", RemoteUrl = "", RemoteIP = "", RemotePort = 0, ActionType = "", InitiatingProcessAccountName = AccountName;
union DnsHits, BareIPBeacon, ComposerPull
| sort by Timestamp desc

<#
.SYNOPSIS
    Security Arsenal IOC Hunt - Packagist iOS Spyware / FunNULL Campaign
.DESCRIPTION
    Checks Windows endpoints and build servers for:
      1. DNS cache entries for FunNULL-linked domains
      2. Active/historical TCP connections to C2 IP 23.225.52.67 or port 4466
      3. Malicious Composer packages in composer.json / composer.lock / vendor dirs
      4. Web server content referencing injected campaign domains
.NOTES
    Run elevated. For fleet-wide sweeps, deploy via SCCM/Intune/EDR Live Response.
#>

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

$BadDomains = @('funnull01.vip','xemphimlau.com','cre-ads.com','ue8im.com','im.ue8im.com')
$C2IP       = '23.225.52.67'
$C2Port     = 4466

Write-Host '[*] 1. Checking DNS resolver cache for campaign domains...' -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache
foreach ($d in $BadDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) {
        $hits | ForEach-Object {
            $Report += [pscustomobject]@{Check='DNS Cache'; Finding=$_.Entry; Detail=$_.Data; Severity='HIGH'}
        }
    }
}

Write-Host '[*] 2. Checking active TCP connections to C2 infrastructure...' -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $C2IP -or $_.RemotePort -eq $C2Port }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess
    $Report += [pscustomobject]@{Check='Network Connection'; Finding="$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort)"; Detail="Process: $($proc.ProcessName) (PID $($c.OwningProcess)) State: $($c.State)"; Severity='CRITICAL'}
}

Write-Host '[*] 3. Scanning for suspicious Composer theme packages...' -ForegroundColor Cyan
$webRoots = @('C:\inetpub','C:\xampp\htdocs','C:\wamp64\www','D:\www','C:\sites')
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        $manifests = Get-ChildItem -Path $root -Recurse -Include 'composer.json','composer.lock' -ErrorAction SilentlyContinue
        foreach ($m in $manifests) {
            $content = Get-Content $m.FullName -Raw
            foreach ($d in $BadDomains) {
                if ($content -match [regex]::Escape($d)) {
                    $Report += [pscustomobject]@{Check='Composer Manifest'; Finding=$m.FullName; Detail="References campaign domain: $d"; Severity='CRITICAL'}
                }
            }
            if ($content -match '"type"\s*:\s*".*theme') {
                $Report += [pscustomobject]@{Check='Composer Manifest'; Finding=$m.FullName; Detail='Theme-type package present - validate vendor namespace against OTX pulse list'; Severity='MEDIUM'}
            }
        }
        # Scan deployed web content for injected campaign JS references
        $injected = Get-ChildItem -Path $root -Recurse -Include '*.php','*.html','*.js' -ErrorAction SilentlyContinue |
                    Select-String -Pattern 'funnull01|cre-ads|ue8im|xemphimlau|vip\d+\.html' -List
        foreach ($hit in $injected) {
            $Report += [pscustomobject]@{Check='Injected Web Content'; Finding=$hit.Path; Detail="Line $($hit.LineNumber): $($hit.Line.Substring(0,[Math]::Min(120,$hit.Line.Length)))"; Severity='CRITICAL'}
        }
    }
}

Write-Host '[*] 4. Checking recently modified vendor/ directories (supply-chain footprint)...' -ForegroundColor Cyan
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Directory -Filter 'vendor' -ErrorAction SilentlyContinue | ForEach-Object {
            $recent = Get-ChildItem $_.FullName -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
            if ($recent.Count -gt 0) {
                $Report += [pscustomobject]@{Check='Vendor Dir Activity'; Finding=$_.FullName; Detail="$($recent.Count) files modified in last 30 days - review recent composer updates"; Severity='LOW'}
            }
        }
    }
}

Write-Host "`n[=] Hunt complete. $($Report.Count) findings." -ForegroundColor Green
if ($Report.Count -gt 0) {
    $Report | Sort-Object Severity | Format-Table -AutoSize -Wrap
    $Report | Export-Csv -Path ".\FunNULL_Packagist_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host '[!] CRITICAL findings require immediate host isolation and dependency audit.' -ForegroundColor Red
} else {
    Write-Host '[+] No indicators found on this host.' -ForegroundColor Green
}