RemotePanel HVNC + BoundSiphon Browser Theft: ClickFix Dual-Payload Campaign — OTX Detection Engineering Brief

Two concurrent threat activity clusters surfaced in the latest OTX intake, and together they paint a coherent picture of the current credential-theft kill chain being run against enterprise endpoints.

Cluster 1 — RemotePanel / BoundSiphon dual-payload toolkit. Two previously undocumented .NET malware components are being delivered through ClickFix social-engineering chains — the fake CAPTCHA / "fix your browser" paste-into-Run-dialog technique that has displaced macro lures as the dominant initial-access vector in 2025–2026. The first stage, RemotePanel, is a full-featured remote access implant: it persists by masquerading as the legitimate Windows Time (W32Time) service, exposes PowerShell execution, file and process management, screen capture, and a modular HVNC (Hidden Virtual Network Computing) capability for invisible interactive sessions, and includes fleet-management logic indicating it is operated at scale against many victims simultaneously. The second component, BoundSiphon, is a dedicated browser credential and cryptocurrency wallet stealer that defeats Chrome's App-Bound Encryption (ABE) — meaning commodity browser-cookie and saved-password theft is viable again even on fully patched Chromium builds. Most notably, RemotePanel resolves its active C2 by reading a BNB Smart Chain contract, a decentralized dead-drop technique that makes takedown of command infrastructure effectively impossible.

Cluster 2 — Year-end phishing infrastructure. A separate but operationally complementary campaign is deploying phishing pages impersonating DocuSign and SharePoint, themed around Q4 business processes: fake compensation adjustments, invoice follow-ups, access reviews, and benefits statements. Targeted verticals include Finance, Technology, Telecommunications, Manufacturing, Real Estate, and Aviation. This is classic pre-positioning: harvest valid credentials now, monetize or hand off to intrusion operators during the holiday staffing trough.

The connective tissue is credential theft at scale. Cluster 2 phishing lures plausibly serve as a delivery or parallel collection vector for the same criminal economy that monetizes BoundSiphon output. Security teams should treat any credential exposure between now and fiscal year-end as potentially feeding an infostealer log marketplace.

Threat Actor / Malware Profile

Attribution for both pulses is currently Unknown — consistent with a malware-as-a-service or independent operator model rather than a named APT.

RemotePanel (RAT / HVNC implant)

• Distribution: ClickFix social engineering — victims are instructed to paste a malicious command (typically mshta, powershell -enc, or curl-based stagers) into the Windows Run dialog or terminal, bypassing email gateway and browser download controls entirely.
• Payload behavior: Modular .NET implant providing remote PowerShell, file/process management, screen access, and HVNC sessions that render an invisible desktop to the operator — enabling hands-on-keyboard fraud from within an authenticated user session.
• C2 communication: Resolves active C2 infrastructure dynamically by querying a BNB Smart Chain smart contract — blockchain dead-drop resolution. Observed fallback/static C2 domains include greatgrgreeng.com and leftsideegpeakk.com (note the algorithmic, doubled-consonant naming pattern).
• Persistence: Masquerades as the Windows Time service — expect a rogue service registration, service DLL, or scheduled task using W32Time-adjacent naming (w32time, W32TimeSvc, similar DisplayName strings) to survive cursory review.
• Anti-analysis: Blockchain C2 resolution defeats static IOC blocking and sinkholing; .NET obfuscation; HVNC operates below the visible session to evade user suspicion and some EDR session monitoring.

BoundSiphon (infostealer)

• Payload behavior: Harvests browser-stored credentials, cookies/session tokens, and cryptocurrency wallet data. Implements an App-Bound Encryption bypass to decrypt Chromium Local State-protected secrets (v20+ cookie encryption) — typically via injection into a running browser process or abuse of Chrome's own COM/elevation path rather than offline decryption.
• Objective: Credential and session-token theft for resale or direct account takeover; wallet draining for immediate monetization.

Year-End Phishing Cluster

• Distribution: DocuSign- and SharePoint-impersonation pages themed on raises, Q4 invoices, and access reviews.
• Infrastructure: Mixed Japan-based hosting (GMO Internet AS7506, NTT AS4713, J:COM AS4721) and compromised legitimate domains (.be, .com.do, .sbs, .com.bd-style TLD spread) — a classic bulletproof-plus-compromised hybrid hosting model.

IOC Analysis

The indicator set spans three operational categories:

• FileHash-SHA256 (6): RemotePanel / BoundSiphon payload hashes. These are point-in-time artifacts — .NET malware is recompiled and repacked constantly, so hashes have a half-life measured in days. Use them for retro-hunting (have we ever executed this binary?) and for pivoting in sandbox/VirusTotal/OTX, not as a forward-looking blocklist.
• C2 domains (2): greatgrgreeng.com, leftsideegpeakk.com — high-value for DNS sinkholing and proxy blocking. Because the implant uses BNB Smart Chain for dynamic C2 resolution, assume additional unseen domains exist; behavior-based detection (below) is mandatory.
• Phishing domains and IPv4s (21): Japan-telecom IP space (157.7.x.x GMO, 118.20.x.x NTT, 123.98.x.x J:COM) and compromised legitimate domains. Block at the email gateway and web proxy; the compromised domains are time-limited indicators, but the ASN clustering is itself a hunt hypothesis — look for user traffic to recently-registered or low-reputation hosts on these networks paired with DocuSign/SharePoint lookalike page titles.

Operationalization: Load all IOCs into your TIP with confidence/decay scoring — hashes decay fastest, C2 domains moderate, phishing IPs slowest. Enrich the SHA256 set through sandbox detonation to extract config (C2 contract address, mutex, service names) for durable detections. The blockchain C2 contract address from the referenced research should be added to your watchlist; querying it reveals the current live C2 better than any static list.

Detection Engineering

---
title: RemotePanel Persistence - Windows Time Service Masquerade
id: 8f3a1c2e-4b7d-4e9a-a1c5-rp0000000001
status: experimental
description: Detects service installation masquerading as the legitimate Windows Time (W32Time) service, a RemotePanel persistence technique delivered via ClickFix chains.
author: Security Arsenal Threat Intel
references:
  - https://blackpointcyber.com/blog/remotepanel-and-boundsiphon-a-dual-payload-toolkit-for-persistent-access-and-browser-theft/
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'sc create'
      - 'sc.exe create'
      - 'New-Service'
  selection_name:
    CommandLine|contains:
      - 'w32time'
      - 'W32Time'
      - 'Windows Time'
  filter_legit:
    CommandLine|contains:
      - 'C:\Windows\System32\svchost.exe -k LocalService'
  condition: selection_cmd and selection_name and not filter_legit
falsepositives:
  - Rare legitimate W32Time service repair by administrators
level: high
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.t1036
---
title: ClickFix User-Executed Stager via Run Dialog or Explorer
id: 8f3a1c2e-4b7d-4e9a-a1c5-rp0000000002
status: experimental
description: Detects mshta, powershell, or curl execution spawned by explorer.exe consistent with ClickFix paste-into-Run social engineering delivering RemotePanel and BoundSiphon.
author: Security Arsenal Threat Intel
date: 2026/10/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  selection_suspicious:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'hidden'
      - '-w hidden'
  condition: selection_parent and selection_child and selection_suspicious
falsepositives:
  - Power users launching scripts from Run dialog; IT admin tooling
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
---
title: BoundSiphon Chromium App-Bound Encryption Bypass via Browser Process Injection
id: 8f3a1c2e-4b7d-4e9a-a1c5-bs0000000003
status: experimental
description: Detects unsigned or non-browser processes accessing Chromium credential stores or spawning under browser processes, consistent with BoundSiphon App-Bound Encryption bypass and cookie theft.
author: Security Arsenal Threat Intel
date: 2026/10/24
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
  selection_file:
    TargetFilename|endswith:
      - '\Local State'
      - '\Cookies'
      - '\Login Data'
      - '\Web Data'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection_path and selection_file and not filter_browsers
falsepositives:
  - Enterprise backup agents; DLP agents; forensic tooling (allowlist by signer and path)
level: critical
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539

// RemotePanel / BoundSiphon + Year-End Phishing IOC & Behavior Hunt — Microsoft Sentinel / MDE
// 1) Network IOC match: C2 domains and phishing infrastructure
let C2Domains = dynamic(["greatgrgreeng.com", "leftsideegpeakk.com"]);
let PhishDomains = dynamic(["rsfashionsdesignbd.com", "bvlbetonvloeren.be", "englaus.sbs", "tropical100.com.do"]);
let PhishIPs = dynamic(["157.7.189.101", "157.7.44.119", "118.20.84.128", "123.98.253.31"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl in~ (C2Domains) or RemoteUrl in~ (PhishDomains) or RemoteIP in (PhishIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// 2) ClickFix behavior: browser/Run-dialog spawned script interpreters reaching network
let ClickFixBehavior = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| where InitiatingProcessParentFileName in~ ("explorer.exe", "chrome.exe", "msedge.exe", "brave.exe")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| project TimeGenerated, DeviceName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// 3) BoundSiphon ABE bypass: non-browser processes touching Chromium credential stores
let BrowserTheft = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\BraveSoftware\\Brave-Browser\\User Data\\")
| where FileName in~ ("Local State", "Cookies", "Login Data", "Web Data")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "msmpeng.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName;
union NetworkHits, ClickFixBehavior, BrowserTheft
| sort by TimeGenerated desc

# RemotePanel / BoundSiphon Host Hunt — run elevated across fleet via EDR/Intune/GPO
# Checks: rogue W32Time-like services, suspicious Run keys, ClickFix prefetch artifacts,
#         C2/phishing DNS cache residue, recent unsigned binaries in user-writable paths

$Report = [ordered]@{}

# 1) Rogue Windows Time service masquerade
$Report['Services'] = Get-CimInstance Win32_Service | Where-Object {
    ($_.Name -match 'w32?time' -or $_.DisplayName -match 'Windows Time') -and
    $_.PathName -notmatch 'system32\\svchost\.exe'
} | Select-Object Name, DisplayName, State, PathName, StartMode

# 2) Unsigned executables in user-writable persistence locations (last 14 days)
$UserPaths = @("$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:TEMP")
$Report['RecentUnsignedBins'] = foreach ($p in $UserPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                [PSCustomObject]@{ Path=$_.FullName; Modified=$_.LastWriteTime; SHA256=(Get-FileHash $_.FullName -Algorithm SHA256).Hash }
            }
        }
}

# 3) Run-key persistence
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
$Report['RunKeyAnomalies'] = foreach ($k in $RunKeys) {
    Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'AppData|Temp|ProgramData' -and $_.Value -match '\.exe|powershell|mshta|rundll32'
        } | Select-Object @{n='Key';e={$k}}, Name, Value
    }
}

# 4) Scheduled tasks masquerading as time/sync components
$Report['SuspiciousTasks'] = Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'time|sync|update' -and
    ($_.Actions.Execute -match 'powershell|mshta|AppData|Temp')
} | Select-Object TaskName, TaskPath, @{n='Action';e={$_.Actions.Execute}}, @{n='Args';e={$_.Actions.Arguments}}

# 5) DNS cache residue for known C2 / phishing domains
$Report['DNSHits'] = Get-DnsClientCache | Where-Object {
    $_.Entry -match 'greatgrgreeng|leftsideegpeakk|rsfashionsdesignbd|bvlbetonvloeren|englaus\.sbs|tropical100'
} | Select-Object Entry, Data, Type

# 6) ClickFix artifact: mshta/powershell prefetch in last 14 days
$Report['ClickFixPrefetch'] = Get-ChildItem 'C:\Windows\Prefetch' -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'MSHTA|POWERSHELL|CURL\.EXE' -and $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    Select-Object Name, LastWriteTime

$Report | ConvertTo-Json -Depth 5

Response Priorities

Immediate (0–24h)

• Block C2 domains (greatgrgreeng.com, leftsideegpeakk.com) and all phishing domains/IPs at DNS, proxy, and email gateway; add the six SHA256 hashes to EDR blocklists for retro-detection.
• Deploy the Sigma and KQL detections above; run the PowerShell hunt script fleet-wide via your EDR live-response or Intune remediation channel.
• Hunt specifically for ClickFix execution chains: explorer.exe → mshta/powershell/curl with network egress is your highest-fidelity tripwire.
• Alert on any non-browser process reading Chromium Local State / Cookies files — treat as confirmed BoundSiphon-class activity until proven otherwise.

24 Hours

• For any host with a detection hit: assume full browser credential and session-token compromise. Force password resets for all accounts authenticated from that endpoint, revoke active sessions/OAuth grants (Entra ID, Google Workspace, Okta), and re-issue MFA tokens.
• Treat cookies as compromised: invalidate session tokens, not just passwords — session hijacking bypasses MFA.
• Audit for cryptocurrency wallet extensions on affected hosts; advise affected users to move funds if wallet theft is suspected.
• Review inbound mail over the past 30 days for DocuSign/SharePoint-themed year-end lures (raises, Q4 invoices, access reviews); reset credentials for any user who interacted.

1 Week

• Neutralize the ClickFix vector: block or alert on mshta.exe and script interpreters spawned by explorer.exe/browsers; deploy Run-dialog paste warnings where EDR supports it; consider restricting powershell.exe to Constrained Language Mode for non-admin users.
• Implement service-creation monitoring (Event ID 7045) with name-masquerade analytics; baseline legitimate services to catch W32Time-style impersonation.
• Harden browser credential exposure: evaluate enterprise browser isolation for high-risk roles, enforce phishing-resistant MFA (FIDO2/passkeys) for finance and HR ahead of year-end phishing peak, and brief staff on Q4-themed lures with concrete examples from this campaign.
• Add blockchain C2-resolution TTPs to threat-model documentation — DNS-layer blocking alone is insufficient against dead-drop resolvers; egress TLS inspection and behavioral analytics are required compensations.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub