title: Prinz Eugen Ransomware C2 Traffic
id: 8e4d2a1f-9b3c-4d5e-8f1a-2b3c4d5e6f7g
status: stable
description: Detects network connections to known Prinz Eugen C2 infrastructure (212.80.7.74) and associated domains.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/25
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|startswith: '212.80.7.'
    selection_domain:
        DestinationHostname|contains:
            - 'stndrdbnk.cc'
            - '.onion'
    condition: 1 of selection*
falsepositives:
    - Legitimate access to these specific IPs is highly unlikely.
level: critical

tags:
    - c2
    - ransomware
    - prinz.eugen

---

title: GitHub Actions Abuse Payload Download
id: 7c3b1a9e-8a2f-3e4d-7g0h-1i2j3k4l5m6n
status: stable
description: Detects processes downloading payloads from the IP associated with the GitHub Actions abuse campaign (43.228.157.68).
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/25
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp: '43.228.157.68'
        DestinationPort: 80
    condition: selection
falsepositives:
    - Unknown
level: high

tags:
    - c2
    - github.actions
    - supply.chain

---

title: PowerShell Prinz Eugen Stager Execution
id: 6d2a0b8d-7c1e-2d3c-6f9g-0h1i2j3k4l5m
status: stable
description: Detects PowerShell execution patterns associated with Prinz Eugen stagers (serverscan.ps1) contacting known C2.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/25
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\powershell.exe'
        - Image|endswith: '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - '212.80.7.74'
            - 'serverscan.ps1'
    condition: all of selection_*
falsepositives:
    - Administrative scripts (very rare)
level: critical

tags:
    - execution
    - powershell
    - ransomware


kql
// Hunt for connections to Prinz Eugen and GitHub Abuse C2 Infrastructure
DeviceNetworkEvents
| where RemoteIP in ("212.80.7.74", "43.228.157.68")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc
;
// Hunt for specific file hashes on endpoints
DeviceFileEvents
| where SHA256 in ("686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4", "22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc


powershell
# IOC Hunt Script for Prinz Eugen & GitHub Abuse Campaigns
# Requires Administrator Privileges

$MaliciousIPs = @("212.80.7.74", "43.228.157.68")
$MaliciousHashes = @(
    "686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4",
    "22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1"
)
$MaliciousDomains = @("stndrdbnk.cc", "baccarat.com.au")

Write-Host "[+] Starting IOC Hunt..." -ForegroundColor Cyan

# 1. Check Active Network Connections
Write-Host "[1] Checking for active connections to malicious IPs..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection -State Established, TimeWait -ErrorAction SilentlyContinue
foreach ($IP in $MaliciousIPs) {
    $Found = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Found) {
        Write-Host "ALERT: Connection found to $IP" -ForegroundColor Red
        $Found | Format-Table LocalAddress, RemoteAddress, State, OwningProcess
    }
}

# 2. Scan Drive C: for Malicious File Hashes (Limited to common user dirs for speed)
Write-Host "[2] Scanning for malicious file hashes..." -ForegroundColor Yellow
$Paths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "ALERT: Malicious file found at $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 3. Check DNS Cache for Malicious Domains
Write-Host "[3] Checking DNS Cache for malicious domains..." -ForegroundColor Yellow
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Domain in $MaliciousDomains) {
    $Found = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Found) {
        Write-Host "ALERT: DNS cache entry found for $Domain" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green


# Response Priorities

**Immediate (0-24h):**
*   **Block Network Traffic:** Immediately firewall block all egress traffic to `212.80.7.74` and `43.228.157.68` at the perimeter.
*   **IOC Sweep:** Deploy the provided PowerShell script across the enterprise to hunt for connections and file hashes.
*   **Token Revocation:** If using LastPass or Klue, rotate API keys and OAuth tokens immediately. Review Salesforce access logs for anomalies originating from Klue integration IPs.

**24-48 Hours:**
*   **GitHub Audit:** Audit all GitHub repositories for unauthorized workflow files (`.github/workflows/*.yml`) and check for unauthorized access to developer accounts.
*   **Identity Verification:** Verify user identities for any suspicious credential resets or logins, particularly in the Finance and Government sectors targeted by ROOTBOY.

**1 Week:**
*   **Patch Management:** Apply patches for CVE-2026-41940 (cPanel/WHM) across all hosting infrastructure.
*   **RMM Hygiene:** Audit RemotePC and other RMM tools for unauthorized access or misuse, ensuring MFA is enforced.
*   **Supply Chain Review:** Conduct a risk assessment of all third-party vendors holding OAuth access to CRM or sensitive data environments.