Remus Stealer & Beagle Backdoor: Aerospace Extortion & AI-Themed Threats — OTX Pulse Analysis

---
title: Remus Stealer C2 Domain Detection
id: 9c6e5e2e-5f1a-4b2c-8e3d-1a2b3c4d5e6f
description: Detects DNS queries associated with Remus (Lumma Stealer) C2 infrastructure.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64bit-lumma/
tags:
    - attack.command_and_control
    - attack.t1071.004
logsource:
    category: dns
product: windows
detection:
    selection:
        query|contains:
            - 'forestoaker.com'
            - 'krondez.com'
            - 'baxe.pics'
            - 'vinte.online'
            - 'coox.live'
            - 'remnane.biz'
            - 'parky.pics'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Beagle Backdoor Fake Claude Site Access
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects DNS queries to the fraudulent Claude-Pro site distributing Beagle backdoor.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/donuts-beagles/
tags:
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: dns
product: windows
detection:
    selection:
        query|contains:
            - 'claude-pro.com'
    condition: selection
falsepositives:
    - Legitimate access to Claude (unlikely for this specific domain)
level: high
---
title: Aerospace Ransomware Payload Detection
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects file creation events matching known ransomware hashes from the aerospace extortion pulse.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/aerospace-extortion/
tags:
    - attack.impact
    - attack.t1486
logsource:
    category: file_event
product: windows
detection:
    selection:
        sha256|contains:
            - '7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82'
            - '180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38'
    condition: selection
falsepositives:
    - Rare
level: critical


kql
// KQL for Microsoft Sentinel
// Hunt for Remus and Beagle C2 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    'forestoaker.com', 'krondez.com', 'baxe.pics', 'vinte.online', 
    'coox.live', 'remnane.biz', 'parky.pics', 'claude-pro.com'
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend ThreatActor = iif(RemoteUrl contains 'claude', 'Beagle/Claude-Impersonator', 'Remus/Lumma-Stealer')
| summarize count() by ThreatActor, DeviceName

// Hunt for Aerospace Ransomware Hashes
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    '7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82',
    '180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38'
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName


powershell
# PowerShell IOC Hunt Script
# Checks Hosts file for malicious domains and scans User directories for specific hashes

$MaliciousDomains = @(
    'forestoaker.com', 'krondez.com', 'baxe.pics', 'vinte.online',
    'coox.live', 'remnane.biz', 'parky.pics', 'claude-pro.com', 'license.claude-pro.com'
)

$TargetHashes = @(
    '7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82',
    '180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38'
)

Write-Host "[+] Checking Hosts file for malicious domains..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $MaliciousDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] ALERT: Domain $Domain found in hosts file!" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scanning User Profiles for known ransomware hashes (This may take time)..." -ForegroundColor Cyan
$UserPaths = @("C:\Users\*")

Get-ChildItem -Path $UserPaths -Include *.exe, *.dll, *.bin -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($TargetHashes -contains $Hash) {
        Write-Host "[!] CRITICAL: Malicious file found: $($_.FullName)" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green