Remus Infostealer v2, Beagle Backdoor, and Aerospace Extortion: OTX Pulse Analysis

---
title: Potential Remus Stealer C2 Activity
id: 4a8f7b12-3c2d-4f5e-8a1b-9c3d4e5f6a7b
description: Detects network connections to known Remus Stealer C2 and distribution domains identified in OTX pulses.
author: Security Arsenal
date: 2026/05/11
status: experimental
references:
    - https://otx.alienvault.com/pulse/64bit-lumma/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'forestoaker.com'
            - 'krondez.com'
            - 'baxe.pics'
            - 'coox.live'
            - 'remnane.biz'
            - 'parky.pics'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Beagle Backdoor DLL Sideloading via G DATA Updater
id: 5b9g8c23-4d3e-5g6f-9b2c-0d4e5f6a7b8c
description: Detects potential DLL sideloading where a suspicious process loads the G DATA Updater DLL, a technique observed in the Beagle backdoor campaign.
author: Security Arsenal
date: 2026/05/11
status: experimental
references:
    - https://otx.alienvault.com/pulse/beagle-claude/
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection_target:
        TargetImage|contains: '\GDUpdat.exe' # or specific DLL name if known
    selection_suspicious:
        SourceImage|contains:
            - 'AppData\\Local\\Temp'
            - 'Downloads'
            - 'claude-pro' # Based on campaign naming
    filter_legit:
        Signed: 'true'
        SourceImage|contains: 'G DATA'
    condition: selection_target and selection_suspicious and not filter_legit
falsepositives:
    - Legitimate G DATA updates from unusual paths (rare)
level: critical
---
title: Suspicious Process Spawn via Steam or Telegram
id: 6c0h9d34-5e4f-6h7g-0c3d-1e5f6g7h8i9j
description: Detects suspicious child processes (CMD, PowerShell, Regsvr32) spawned by Steam or Telegram, typical of infostealer dead drop resolvers like Remus/Lumma.
author: Security Arsenal
date: 2026/05/11
status: experimental
references:
    - https://otx.alienvault.com/pulse/64bit-lumma/
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\steam.exe'
            - '\telegram.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate user interaction using these platforms to launch scripts
level: medium

// Hunt for Remus C2 Connections and Beagle Domains
let RemusDomains = dynamic(['forestoaker.com', 'krondez.com', 'baxe.pics', 'coox.live', 'remnane.biz', 'parky.pics']);
let BeagleDomains = dynamic(['claude-pro.com', 'license.claude-pro.com']);
DeviceNetworkEvents
| where (RemoteUrl has_any (RemusDomains) or RemoteUrl has_any (BeagleDomains)) 
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend ThreatType = iff(RemoteUrl has_any (RemusDomains), "Remus Stealer C2", "Beagle Backdoor Infrastructure")

# IOC Hunt for Remus and Beagle Activity
# Requires Admin Privileges

Write-Host "Starting Threat Hunt: Remus & Beagle IOCs" -ForegroundColor Cyan

# 1. Check for Malicious File Hashes (Remus/Aerospace Payloads)
$MaliciousHashes = @( 
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d", 
    "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82",
    "180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38"
)

Write-Host "Scanning for malicious file hashes..." -ForegroundColor Yellow
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($Drive in $Drives) {
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $Hash) {
            Write-Host "[MALWARE FOUND] $($_.FullName) - Hash: $Hash" -ForegroundColor Red
        }
    }
}

# 2. Check Hosts File for Beagle/Remus Domains
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$SuspiciousDomains = @("claude-pro.com", "forestoaker.com", "krondez.com", "remnane.biz")

Write-Host "Checking Hosts file for suspicious domains..." -ForegroundColor Yellow
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Line in $HostsContent) {
        if (-not $Line.StartsWith("#") -and $Line.Trim() -ne "") {
            foreach ($Domain in $SuspiciousDomains) {
                if ($Line -like "*$Domain*") {
                    Write-Host "[HOSTS FILE MODIFICATION] Line: $Line" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "Hunt Complete." -ForegroundColor Green