RedHook RAT & Clubfoot Wolf OTX Pulse Analysis — Cloud Abuse & Remote Access Trojan Surge

---
title: Potential RedHook RAT C2 Activity
id: 2d3c8a9a-1f4b-4c8a-9b1c-1d2e3f4a5b6c
description: Detects network connections to known RedHook C2 infrastructure domains related to the Android RAT campaign.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    product: zeek
    category: dns
detection:
    selection:
        query|contains:
            - '.3n7wj.com'
    condition: selection
falsepositives:
    - Unknown
level: high
tags:
    - c2
    - mobile.malware
    - redhook
---
title: Clubfoot Wolf PowerShell Loader
id: 5e6f7a8b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
description: Detects suspicious PowerShell execution patterns often used by Clubfoot Wolf to load NetSupport Manager.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'NetSupport'
            - 'client32.dll'
            - 'DownloadString'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Administrative scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - clubfoot.wolf
---
title: Suspicious LogMeIn Installation from Vercel
id: 9a0b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
description: Detects installation of LogMeIn binaries initiated following a connection to Vercel hosting infrastructure, indicative of the phishing campaign.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    product: windows
    service: process_creation
detection:
    selection_image:
        Image|contains:
            - 'msiexec.exe'
            - 'LogMeIn.exe'
    selection_parent:
        ParentImage|endswith:
            - '\browser.exe'
            - 'chrome.exe'
            - 'firefox.exe'
            - 'msedge.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'Invoice'
            - '.exe.bin'
    condition: all of selection_*
falsepositives:
    - Legitimate admin installs
level: critical
tags:
    - attack.initial_access
    - attack.t1204
    - vercel.abuse

// Hunt for RedHook C2 Network Activity
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "3n7wj.com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

// Hunt for Clubfoot Wolf LNK and PowerShell Activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "cmd.exe" or FileName =~ "powershell.exe")
| where ProcessCommandLine has_any ("NetSupport", "client32.dll", "imhfamily.com")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

// Hunt for Suspicious LogMeIn Installation
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has "msiexec.exe" or ProcessCommandLine has "LogMeIn"
| where InitiatingProcessFileName has_any ("chrome.exe", "firefox.exe", "msedge.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

# Registry and File Persistence Hunt for LogMeIn and RedHook Artifacts

# Check for unusual LogMeIn installations (Persistence)
$logmein_paths = @(
    "HKLM:\SOFTWARE\LogMeIn",
    "HKCU:\Software\LogMeIn"
)

Write-Host "Checking for LogMeIn Registry Persistence..."
foreach ($path in $logmein_paths) {
    if (Test-Path $path) {
        Write-Host "[!] FOUND: $path" -ForegroundColor Red
        Get-ItemProperty $path | Format-List
    }
}

# Check file system for specific IOCs (Invoice files)
Write-Host "Scanning user directories for Invoice executables..."
$users = Get-ChildItem "C:\Users" -Directory
foreach ($user in $users) {
    $targetPath = "C:\Users\$($user.Name)\Downloads"
    if (Test-Path $targetPath) {
        $files = Get-ChildItem $targetPath -Filter "Invoice*.exe*" -ErrorAction SilentlyContinue
        if ($files) {
            Write-Host "[!] FOUND suspicious Invoice file in $($user.Name) profile" -ForegroundColor Red
            $files | Select-Object FullName, CreationTime, LastWriteTime
        }
    }
}