Threat Summary
These three pulses are not evidence of one single actor, but they show the same criminal economy converging on trusted infrastructure and under-managed edge systems. PoeLLM is exploiting exposed AI and developer-adjacent services such as LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry to deploy XMRig and related tooling, using a GitHub-hosted poem as a dead-drop resolver for C2 selection. NEBULA is a software supply-chain operation in which seven malicious npm packages posed as a NebulaAI SDK and delivered the Windows KNTRAT remote-access trojan, with api-nebula and llm-nebula reported still downloadable. The Refrigerator Botnet shows Dixell/Copeland XWEB PRO refrigeration controllers, common in retail and cold-storage environments, being converted into SMTP/proxy abuse infrastructure rather than being used for classic destructive ICS activity.
Collectively, the intrusion logic is: find exposed or implicitly trusted control planes, execute low-noise monetization payloads, and hide command channels inside legitimate ecosystems. Objectives include compute theft for cryptocurrency mining, Windows endpoint compromise for remote access and credential/token exposure, and abuse of compromised OT HTTP/SMTP reachability for spam and proxying. The common enterprise risk is an external-facing service, developer workstation, or retail OT controller becoming a financially useful node before it is treated as a security incident.
Threat Actor / Malware Profile
PoeLLM / XMRig / Iron cluster: Attribution is unknown and motivation appears financial. Distribution is opportunistic exploitation of internet-exposed AI, document-processing, source-control, and remote-access services, including CVEs referenced in the pulse such as CVE-2026-10520, CVE-2026-42271, and CVE-2018-21027. Payload behavior centers on deploying miners and Linux tooling from staging URLs such as http://5.78.73.122:81/private/bins.sh and http://5.78.73.122:81/private/python3.6. C2 is unusual: infected systems derive server addresses from keywords embedded in a poem hosted on GitHub, a dead-drop/DGA-like technique that abuses a high-reputation domain and complicates static blocklisting. Expect persistence through cron, systemd units, rc.local, container entrypoints, or newly created local users on Linux hosts; verify per host rather than assuming one mechanism. Anti-analysis likely includes living-off-the-land installers, miner config separation, rotating GitHub content, and use of mining pool infrastructure such as edge-ru-07.kryptex.network to blend with legitimate traffic.
NEBULA / KNTRAT npm operation: The actor used four sequential burner accounts, nebulallms through nebulallms4, and published seven packages masquerading as a NebulaAI SDK. The packages present a convincing AI client facade while hiding obfuscated logic that delivers a Windows RAT reported as needing no DLL, consistent with reflective, in-memory, or script/LOLBins-heavy execution rather than a classic dropped DLL. Distribution is npm install, postinstall, dependency confusion, and developer workstation/CI compromise. C2 indicators include api.nebulaai.dev, https://api.nebulaai.dev/v2, fact-register.md, and uberip.com. Persistence should be hunted in Run keys, scheduled tasks, Startup folder, npm global hooks, and developer shell profiles; exact mechanism was not enumerated in the pulse. Anti-analysis includes package-name typosquatting, rapid burner-account rotation, obfuscated JavaScript, plausible AI SDK branding, and selective Windows payload staging.
Refrigerator Botnet / Dixell-Copeland XWEB PRO: No malware family is named; the risk is compromised abuse infrastructure. Exposed XWEB PRO controllers used by supermarkets and cold-storage operators remain internet reachable and vulnerable, especially CVE-2026-25085, with CVE-2026-109618 and CVE-2026-109619 also listed. Three of nine observed IPs were confirmed as refrigeration controllers. Payload behavior is outbound SMTP spam/proxy abuse, not necessarily payload execution on Windows endpoints. Persistence is device compromise, weak/default credentials, unpatched firmware, and exposure of management interfaces. The anti-detection advantage is that retail refrigeration controllers are rarely in EDR scope, often sit outside corporate identity telemetry, and can emit legitimate-looking TCP 25/587 or HTTP management traffic.
IOC Analysis
The indicator set mixes infrastructure, exploit, and payload artifacts. Domains and hostnames such as malwarescan.xyz, api.nebulaai.dev, fact-register.md, uberip.com, and edge-ru-07.kryptex.network should be blocked at DNS, secure web gateway, and EDR network layers while preserving full packet and DNS query logs for retro-hunt. IPv4 indicators 84.1.34.242, 78.21.151.21, 90.0.156.128, 160.19.119.226, and 168.195.122.22 are suspected SMTP botnet nodes; treat them as abuse infrastructure first, not necessarily enterprise C2, and alert on inbound connections to retail/OT segments plus any internal host initiating unexpected SMTP. URLs with 5.78.73.122:81/private/ are high-value staging artifacts for proxy and EDR download events. SHA256 hashes 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501, 5222dd57b8859e791a16abcf7f616bbc59f8cf248798c7c8c2ba800f0b52cd8c, 8bc90df9b387849338d9c61a8d379cfbb0d70ea576c0e37e1fb07ba164921807, e99bab7b8bbbde7c821dae4ccfedfd1e608d65c466de9b08037c5ce5f56af3b1, and f0d36ac2d75c81a4c3cbdbf2f717db858f2876e6a1cc74f2d36b729a1dd51a5e should be pushed into EDR block/watch lists and matched against software inventory, npm cache, CI artifacts, temp directories, and email/web download stores.
Operationalize by importing pulses into MISP/OpenCTI or your TIP, then synchronizing to Sentinel threat intelligence, Defender indicators, CrowdStrike IOCs, Palo Alto EDLs, Cisco Umbrella, Zscaler, Suricata/Zeek intel frameworks, and proxy categorization. Add CVEs to attack-surface management: XWEB PRO, LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry, and developer npm consumption. For npm, do not rely only on package name; compare lockfile integrity, registry metadata, install scripts, maintainers, and postinstall network destinations using npm audit, Socket, Snyk, Artifactory/Xray, or an internal proxy that logs package retrieval.
Detection Engineering
---
title: PoeLLM AI Service Exploit Spawns Linux Installer or Miner
id: 8d28ad1c-2d9a-4e7d-9b6b-poellm-ai-miner-001
status: experimental
description: Detects AI or open-source service processes spawning shell downloaders or XMRig/Iron miner behavior associated with PoeLLM staging and mining infrastructure.
logsource:
category: process_creation
product: linux
author: Security Arsenal
date: 2026/11/08
tags:
- attack.t1105
- attack.t1496
- attack.t1071.001
detection:
selection_parent:
ParentImage|endswith:
- '/ollama'
- '/litellm'
- '/gotenberg'
- '/gitea'
- '/node'
- '/python'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/curl'
- '/wget'
- '/python'
- '/python3'
- '/xmrig'
- '/iron'
selection_cmd:
CommandLine|contains:
- '5.78.73.122'
- '/private/bins.sh'
- 'stratum+tcp'
- 'donate-level'
- 'malwarescan.xyz'
- 'xmrig'
condition: selection_parent and (selection_child or selection_cmd)
falsepositives:
- Legitimate AI service extensions and package managers; baseline parent-child trees for Ollama, LiteLLM, Gotenberg, and Gitea.
level: high
---
title: NEBULA npm KNTRAT Install and C2
id: 7dbbb7dc-59b4-43cd-9f8b-nebula-kntrat-npm-002
status: experimental
description: Detects npm or node execution installing fake NebulaAI SDK packages or Windows endpoints contacting KNTRAT infrastructure.
logsource:
category: process_creation
product: windows
author: Security Arsenal
date: 2026/11/08
tags:
- attack.t1195.001
- attack.t1059
- attack.t1071.001
- attack.t1027
detection:
selection_proc:
Image|endswith:
- '\node.exe'
- '\npm.exe'
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
selection_cli:
CommandLine|contains:
- 'nebulaai'
- 'api-nebula'
- 'llm-nebula'
- 'nebulallms'
- 'api.nebulaai.dev'
- 'uberip.com'
- 'fact-register.md'
- '-enc'
- 'FromBase64String'
- 'postinstall'
condition: selection_proc and selection_cli
falsepositives:
- Valid SDK evaluation can be rare; flag only when package names, burner maintainers, encoded commands, or listed infrastructure align.
level: critical
---
title: Unexpected SMTP Abuse From Server OT or Retail Segment
id: 3f090f0f-58d0-4fd9-a25d-xweb-smtp-abuse-003
status: experimental
description: Flags non-mail assets, including OT or retail refrigeration controller VLANs, initiating outbound SMTP bursts consistent with XWEB PRO abuse infrastructure.
logsource:
category: network_connection
product: windows
author: Security Arsenal
date: 2026/11/08
tags:
- attack.t1071.003
- attack.t1090
- attack.t1190
detection:
selection_dstport:
DestinationPort:
- 25
- 587
- 465
selection_initiated:
Initiated: true
filter_mail_relays:
SourceHost|contains:
- 'MAIL'
- 'EXCH'
- 'SMTP'
filter_ioc_destination:
DestinationIp:
- '84.1.34.242'
- '78.21.151.21'
- '90.0.156.128'
- '160.19.119.226'
- '168.195.122.22'
condition: selection_dstport and selection_initiated and not filter_mail_relays and not 1 of filter_ioc_destination*
falsepositives:
- Printers, scanners, application alerts, and backup appliances may send mail; maintain an approved SMTP sender inventory and alert on deviations.
level: high
let BadDomains = dynamic(['malwarescan.xyz','api.nebulaai.dev','fact-register.md','uberip.com','edge-ru-07.kryptex.network']);
let BadIPs = dynamic(['5.78.73.122','84.1.34.242','78.21.151.21','90.0.156.128','160.19.119.226','168.195.122.22']);
let BadHashes = dynamic(['6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501','5222dd57b8859e791a16abcf7f616bbc59f8cf248798c7c8c2ba800f0b52cd8c','8bc90df9b387849338d9c61a8d379cfbb0d70ea576c0e37e1fb07ba164921807','e99bab7b8bbbde7c821dae4ccfedfd1e608d65c466de9b08037c5ce5f56af3b1','f0d36ac2d75c81a4c3cbdbf2f717db858f2876e6a1cc74f2d36b729a1dd51a5e']);
union
(DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (BadDomains) or RemoteIP in (BadIPs) or (RemotePort in (25,465,587) and DeviceName !contains 'MAIL' and DeviceName !contains 'SMTP')
| project Timestamp, DeviceName, ActionType, RemoteIP, RemotePort, RemoteUrl, LocalIP, LocalPort, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
| where Timestamp > ago(14d)
| where SHA256 in (BadHashes) or FileName in~ ('xmrig.exe','iron.exe','node.exe','npm.exe') or ProcessCommandLine has_any ('api.nebulaai.dev','llm-nebula','api-nebula','nebulallms','/private/bins.sh','stratum+tcp','malwarescan.xyz','donate-level','FromBase64String')
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName)
| sort by Timestamp desc
$ErrorActionPreference='SilentlyContinue'
$domains='malwarescan.xyz','api.nebulaai.dev','fact-register.md','uberip.com','edge-ru-07.kryptex.network'
$ips='5.78.73.122','84.1.34.242','78.21.151.21','90.0.156.128','160.19.119.226','168.195.122.22'
$hashes='6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501','5222dd57b8859e791a16abcf7f616bbc59f8cf248798c7c8c2ba800f0b52cd8c','8bc90df9b387849338d9c61a8d379cfbb0d70ea576c0e37e1fb07ba164921807','e99bab7b8bbbde7c821dae4ccfedfd1e608d65c466de9b08037c5ce5f56af3b1','f0d36ac2d75c81a4c3cbdbf2f717db858f2876e6a1cc74f2d36b729a1dd51a5e'
Write-Host '[+] Network IOC hits'
Get-NetTCPConnection | Where-Object {$ips -contains $_.RemoteAddress -or $_.RemotePort -in 25,465,587} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Get-DnsClientCache | Where-Object { $d=$_.Entry; $domains | ForEach-Object { $d -like ('*'+$_+'*') } } | Select-Object Entry,RecordName,Data
Write-Host '[+] Process and command-line artifacts'
Get-CimInstance Win32_Process | Where-Object {$_.CommandLine -match 'xmrig|stratum\+tcp|donate-level|/private/bins.sh|nebulaai|api-nebula|llm-nebula|nebulallms|FromBase64String|uberip|fact-register'} | Select-Object ProcessId,Name,ExecutablePath,CommandLine
Write-Host '[+] Hash sweep in high-risk paths'
$paths="$env:TEMP","$env:LOCALAPPDATA\npm-cache","$env:APPDATA\npm","$env:USERPROFILE\node_modules","$env:ProgramData"
foreach($p in $paths){ if(Test-Path $p){ Get-ChildItem $p -Recurse -File -Include *.exe,*.dll,*.js,*.ps1 -ErrorAction SilentlyContinue | Select-Object -First 2000 | ForEach-Object { $h=(Get-FileHash $_.FullName -Algorithm SHA256).Hash; if($hashes -contains $h){ [PSCustomObject]@{Path=$_.FullName;SHA256=$h} } } } }
Write-Host '[+] Persistence locations'
$run='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
foreach($r in $run){ Get-ItemProperty $r | Select-Object * | Out-String | Where-Object {$_ -match 'node|npm|xmrig|iron|nebula|powershell|cmd'} }
Get-ScheduledTask | Where-Object {$_.TaskName -match 'nebula|npm|node|xmrig|iron|canto|poem' -or $_.Actions.Arguments -match 'nebula|xmrig|FromBase64String'} | Select-Object TaskName,TaskPath,State
Get-CimInstance Win32_Service | Where-Object {$_.Name -match 'xmrig|iron|nebula|node' -or $_.PathName -match 'Temp|AppData|node_modules|xmrig|nebula'} | Select-Object Name,State,StartMode,PathName
Write-Host '[+] SMTP sender inventory review'
Get-CimInstance Win32_ComputerSystem | Select-Object Name,Domain
Response Priorities
Immediate: Block listed domains, hostnames, URLs, hashes, and IPv4 abuse nodes at DNS, SWG, EDR, firewall, and mail gateway; add GitHub content-retrieval monitoring for the poem-based resolver pattern without blocking GitHub wholesale. Quarantine developer machines and CI runners that installed api-nebula, llm-nebula, or any nebulallms package. Isolate refrigeration/OT VLANs from internet SMTP and prohibit outbound TCP 25/587/465 except approved relays. Hunt for bins.sh, python3.6 staging, XMRig configs, miner pool traffic, npm postinstall execution, and unexpected service parent-child trees under Ollama, LiteLLM, Gotenberg, Gitea, and Ivanti.
24h: Because KNTRAT is a Windows RAT and AI SDK targeting implies credential and token theft, rotate npm tokens, GitHub credentials, cloud keys, LLM provider keys, package registry tokens, browser-stored session material, and any service account touched by affected builds. Force MFA reauthentication and revoke OAuth grants for impacted developers. Review mailbox and outbound mail logs for spam from retail networks. For PoeLLM hosts, check for added Linux users, cron/systemd changes, container drift, and cloud API keys stored on AI gateways.
1 week: Move LLM and document services behind authenticated private gateways with egress allowlists; remove direct internet exposure for Ollama, LiteLLM, Gotenberg, Gitea, and Ivanti Sentry. Patch or compensate for CVE-2026-10520, CVE-2026-42271, CVE-2018-21027, CVE-2026-25085, CVE-2026-109618, and CVE-2026-109619 after validating vendor guidance. Enforce npm provenance/Sigstore, lockfile pinning, CI artifact signing, dependency firewall rules, and malware scanning before publish/install. Segment retail OT controllers, deploy passive ICS monitoring, require jump-host administration, disable unused SMTP, and set explicit baselines for controller DNS/NTP/HTTP so abuse traffic stands out.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.