Remus Infostealer & Aerospace Ransomware: Multi-Vector Threat Landscape — OTX Pulse Analysis

---
title: Remus Infostealer C2 Communication Detection
id: 6c8f7d2e-4a3b-45c6-9d1e-8f7a6b5c4d3e
description: Detects network connections to known Remus infostealer C2 domains
author: Security Arsenal
date: 2026/05/08
tags:
  - attack.command_and_control
  - attack.exfiltration
status: stable
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - forestoaker.com
      - krondez.com
      - baxe.pics
      - vinte.online
      - coox.live
      - remnane.biz
      - parky.pics
  condition: selection
falsepositives:
  - Legitimate access to these domains (unlikely)
level: critical
---
title: Fake Claude AI Website and Beagle Backdoor
id: 7d9f8e3f-5b4c-56d7-0e2f-9g8b7c6d5e4f1
description: Detects connections to fake Claude AI website distributing Beagle backdoor
author: Security Arsenal
date: 2026/05/08
tags:
  - attack.initial_access
  - attack.execution
status: stable
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - claude-pro.com
      - license.claude-pro.com
  condition: selection
falsepositives:
  - Legitimate access to Claude AI (should use anthropic.com)
level: high
---
title: DLL Sideloading via G DATA Updater
id: 8e0g9f4g-6c5d-67e8-1f3g-0h9c8d7e6f5g2
description: Detects potential DLL sideloading via signed G DATA antivirus updater (used by Beagle)
author: Security Arsenal
date: 2026/05/08
tags:
  - attack.defense_evasion
  - attack.persistence
status: stable
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: 'G DATA'
    Signed: false
  condition: selection
falsepositives:
  - Legitimate G DATA component loading
level: medium


kql
// Hunt for Remus infostealer C2 communications
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("forestoaker.com", "krondez.com", "baxe.pics", "vinte.online", "coox.live", "remnane.biz", "parky.pics", "claude-pro.com", "license.claude-pro.com")
| summarize count() by DeviceName, RemoteUrl, InitiatingProcessFileName
| order by count_ desc

// Hunt for Beagle backdoor DLL sideloading
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has "G DATA" and ProcessCommandLine has ".dll"
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, SHA256

// Hunt for malicious file hashes
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in ("b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d", "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82", "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38")
| project DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName


powershell
# Remus and Beagle Backdoor Hunt Script
# Version 1.0 - 2026-05-08
# Author: Security Arsenal Threat Intelligence

# Define malicious file hashes from OTX pulses
$maliciousHashes = @(
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d",
    "95daa771a28eaed76eb01e1e8f403f7c",
    "cdd5717fd3bfd375c1c34237c24073e92ad6dccc",
    "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82",
    "5e1f61b9c1c27cad3b7a81c804ac7b86",
    "c1888ba296f57e87a84411ddfce3cabc4536b142",
    "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38"
)

# Define malicious domains
$maliciousDomains = @(
    "forestoaker.com",
    "krondez.com",
    "baxe.pics",
    "vinte.online",
    "coox.live",
    "remnane.biz",
    "parky.pics",
    "claude-pro.com",
    "license.claude-pro.com"
)

function Write-ColorOutput {
    param([string]$Message, [string]$Color)
    Write-Host $Message -ForegroundColor $Color
}

Write-ColorOutput "========================================" "Cyan"
Write-ColorOutput "REMUS & BEAGLE THREAT HUNT SCRIPT" "Cyan"
Write-ColorOutput "Security Arsenal - 2026-05-08" "Cyan"
Write-ColorOutput "========================================" "Cyan"

# Check for known malicious file hashes
Write-ColorOutput "`n[1] Scanning for malicious files..." "Yellow"
$foundFiles = 0
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $maliciousHashes) {
            Write-ColorOutput "  MALICIOUS FILE FOUND: $($_.FullName)" "Red"
            Write-ColorOutput "  Hash: $hash" "Red"
            $foundFiles++
        }
    } catch {}
}
if ($foundFiles -eq 0) { Write-ColorOutput "  No malicious files found" "Green" }

# Check for DNS cache entries
Write-ColorOutput "`n[2] Checking DNS cache for malicious domains..." "Yellow"
$foundDNS = 0
Get-DnsClientCache | Where-Object { $maliciousDomains -contains $_.Entry } | ForEach-Object {
    Write-ColorOutput "  MALICIOUS DNS ENTRY: $($_.Entry)" "Red"
    Write-ColorOutput "  Data: $($_.Data)" "Red"
    $foundDNS++
}
if ($foundDNS -eq 0) { Write-ColorOutput "  No malicious DNS entries found" "Green" }

# Check for suspicious scheduled tasks
Write-ColorOutput "`n[3] Checking for suspicious scheduled tasks..." "Yellow"
$foundTasks = 0
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*claude*" -or $_.Actions.Execute -like "*remus*" -or $_.TaskName -like "*claude*" -or $_.TaskName -like "*remus*" } | ForEach-Object {
    Write-ColorOutput "  SUSPICIOUS TASK FOUND: $($_.TaskName)" "Red"
    Write-ColorOutput "  Command: $($_.Actions.Execute) $($_.Actions.Arguments)" "Red"
    $foundTasks++
}
if ($foundTasks -eq 0) { Write-ColorOutput "  No suspicious tasks found" "Green" }

# Check for suspicious registry run keys
Write-ColorOutput "`n[4] Checking registry persistence mechanisms..." "Yellow"
$foundRegistry = 0
$runPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($path in $runPaths) {
    if (Test-Path $path) {
        $properties = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue
        foreach ($prop in $properties.PSObject.Properties) {
            if ($prop.Name -notlike "PS*" -and $prop.Value -is [string]) {
                if ($prop.Value -like "*claude*" -or $prop.Value -like "*remus*" -or $prop.Value -like "*krondez*" -or $prop.Value -like "*baxe*" -or $prop.Value -like "*forestoaker*") {
                    Write-ColorOutput "  SUSPICIOUS REGISTRY ENTRY:" "Red"
                    Write-ColorOutput "    Path: $path\$($prop.Name)" "Red"
                    Write-ColorOutput "    Value: $($prop.Value)" "Red"
                    $foundRegistry++
                }
            }
        }
    }
}
if ($foundRegistry -eq 0) { Write-ColorOutput "  No suspicious registry entries found" "Green" }

# Summary
Write-ColorOutput "`n========================================" "Cyan"
Write-ColorOutput "HUNT SUMMARY" "Cyan"
Write-ColorOutput "========================================" "Cyan"
Write-ColorOutput "Malicious files found: $foundFiles" "$(if ($foundFiles -gt 0) { 'Red' } else { 'Green' })"
Write-ColorOutput "Malicious DNS entries: $foundDNS" "$(if ($foundDNS -gt 0) { 'Red' } else { 'Green' })"
Write-ColorOutput "Suspicious tasks: $foundTasks" "$(if ($foundTasks -gt 0) { 'Red' } else { 'Green' })"
Write-ColorOutput "Suspicious registry entries: $foundRegistry" "$(if ($foundRegistry -gt 0) { 'Red' } else { 'Green' })"
Write-ColorOutput "`nHunt complete." "Green"