Remus Infostealer, PCPJack Cloud Worm & NuGet Supply Chain: Enterprise Credential Theft Analysis

title: Suspicious Connection To Infostealer C2 Domains
description: Detects network connections to known C2 domains associated with Remus, Lumma, and PCPJack campaigns based on OTX Pulse data.
status: stable
date: 2026/05/10
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/66000000...
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        initiated|true: true
        destination|contains:
            - 'forestoaker.com'
            - 'krondez.com'
            - 'baxe.pics'
            - 'dns-providersa2.com'
            - 'lastpass-login-help.com'
            - 'teampcp'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Malicious NuGet Package Execution
description: Detects execution of processes with file hashes matching the malicious NuGet packages identified in OTX Pulses.
status: stable
date: 2026/05/10
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/66000000...
tags:
    - attack.initial_access
    - attack.t1195.001
logsource:
    category: process_creation
product: windows
detection:
    selection:
        sha256|contains:
            - '019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824'
            - '34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c'
            - '596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1'
            - 'e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a'
            - 'b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d'
    condition: selection
falsepositives:
    - None (Legitimate software will not match these hashes)
level: critical
---
title: Potential PAN-OS Exploitation via Suspicious User-Agent
description: Detects potential exploitation attempts or post-exploitation traffic associated with PAN-OS zero-day activity observed in the wild.
status: experimental
date: 2026/05/10
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/66000000...
tags:
    - attack.exploitation
    - attack.t1190
logsource:
    category: proxy
product: null
detection:
    selection:
        c-useragent|contains:
            - 'python-requests/'
            - 'curl/'
        dest_port|equals: 443
        sc-status|contains:
            - '200'
            - '404'
    filter_mainstream:
        dest_host|contains:
            - 'google.com'
            - 'microsoft.com'
            - 'apple.com'
    condition: selection and not filter_mainstream
falsepositives:
    - Legitimate administrative scripts
level: high

// Hunt for C2 connections and file hashes from OTX Pulses
let MaliciousDomains = dynamic(['forestoaker.com', 'dns-providersa2.com', 'lastpass-login-help.com', 'krondez.com', 'vinte.online']);
let MaliciousHashes = dynamic(['019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824', 'e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a', 'b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d']);
// Network Connections
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) or RemoteUrl hasAny (MaliciousDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| union (
    // File Creation/Process Execution
    DeviceProcessEvents
    | where SHA256 in (MaliciousHashes)
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
)

<#
.SYNOPSIS
    Scans local NuGet cache and common temp directories for malicious file hashes associated with recent OTX pulses.
#>

$MaliciousHashes = @(
    '019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824',
    '34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c',
    '596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1',
    'e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a',
    'b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d',
    '197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6',
    '6c6cbed6aad96564ed87094785be07a1'
)

$SearchPaths = @(
    "$env:USERPROFILE\.nuget\packages",
    "$env:LOCALAPPDATA\Temp",
    "C:\Windows\Temp"
)

Write-Host "Starting scan for OTX Pulse Indicators..." -ForegroundColor Cyan

foreach ($path in $SearchPaths) {
    if (Test-Path $path) {
        Write-Host "Scanning $path..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[MALICIOUS] Found: $($_.FullName)" -ForegroundColor Red
            }
        }
    } else {
        Write-Host "Path not found: $path" -ForegroundColor Gray
    }
}
Write-Host "Scan complete." -ForegroundColor Cyan