title: Remus Stealer C2 Connection - DNS Query
id: c0ffee01-2026-remus-dns
description: Detects DNS queries to known Remus Stealer C2 domains identified in OTX pulses.
author: Security Arsenal
status: experimental
date: 2026/05/08
tags:
    - attack.command_and_control
    - attack.t1071.004
logsource:
    category: dns
condition: selection
selection:
    query|contains:
        - 'forestoaker.com'
        - 'krondez.com'
        - 'baxe.pics'
        - 'vinte.online'
        - 'coox.live'
        - 'remnane.biz'
        - 'parky.pics'
falsepositives:
    - Unknown
level: critical
---
title: Suspicious G DATA Updater DLL Sideloading - Beagle
description: Detects potential Beagle backdoor execution via DLL sideloading using the signed G DATA updater (gup.exe).
id: c0ffee02-2026-beagle-sideloading
author: Security Arsenal
status: experimental
date: 2026/05/08
references:
    - https://www.sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoor
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\gup.exe'
        Image|contains:
            - '\AppData\'
            - '\Temp\'
        Signed: 'false'
    condition: selection
falsepositives:
    - Legitimate G DATA update failures (rare)
level: high
---
title: Fake Claude AI Site Network Access
description: Detects network connections to the malicious Claude-Pro domain used for Beagle distribution.
id: c0ffee03-2026-claude-malware
author: Security Arsenal
status: experimental
date: 2026/05/08
tags:
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith:
            - 'claude-pro.com'
    condition: selection
falsepositives:
    - Unknown
level: critical


kql
// Hunt for Remus and Beagle IOCs in Network and Process Events
// Network Connections to Malicious Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("forestoaker.com", "krondez.com", "claude-pro.com", "baxe.pics", "vinte.online")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP

// Process Creation for Malicious Hashes (Remus/Ransomware samples)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d",
    "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82",
    "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256


powershell
# IOC Hunt Script for Remus and Beagle Artifacts
# Requires Administrator privileges

$MaliciousHashes = @( 
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d",
    "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82",
    "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38"
)

$MaliciousDomains = @(
    "forestoaker.com", "krondez.com", "claude-pro.com"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Yellow

# Scan common temp and appdata directories
$PathsToScan = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object { 
            $_.Length -gt 0kb -and $_.Length -lt 100mb 
        } | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | SHA256: $Hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking Hosts file for malicious domains..." -ForegroundColor Yellow
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    Select-String -Path $HostsPath -Pattern $MaliciousDomains | ForEach-Object {
        Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $($_.Line)" -ForegroundColor Red
    }
}

Write-Host "[+] Checking DNS Cache for C2 communication..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } | ForEach-Object {
    Write-Host "[!] DNS CACHE HIT: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:**
    *   Block all listed domains (`forestoaker.com`, `claude-pro.com`, etc.) at the perimeter, proxy, and DNS levels.
    *   Isolate endpoints with positive hash matches for Remus or Aerospace ransomware binaries.
    *   Kill network connections to `claude-pro.com` and investigate the source process (likely browser or download manager).

*   **24 Hours:**
    *   Initiate credential reset for users who may have interacted with the "Claude-Pro" download or visited Steam/Telegram links associated with Remus.
    *   Review G DATA updater logs for anomalies or unauthorized DLL loads.
    *   Sweep aerospace/aviation segmented networks for the LockBit/Cl0p file hashes provided in Pulse 2.

*   **1 Week:**
    *   Implement application signing enforcement to prevent the abuse of signed binaries like `gup.exe` for sideloading.
    *   Update proxy categorization to block newly registered domains serving AI-related utilities.
    *   Conduct supply chain risk assessments for third-parties with access to aerospace engineering platforms.