Rhysida, Gremlin & Lumma Infostealers: Multi-Vector Credential Theft Campaigns — OTX Pulse Analysis

---
title: Suspicious Child Process of Wallpaper Engine
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects Wallpaper Engine (Steam) spawning suspicious archive utilities or script interpreters, indicative of malware distribution via Steam Workshop.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a1b2c3d4e5f
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\wallpaper32.exe'
    filter_legit:
        Image|endswith:
            - '\rundll32.exe'
            - '\explorer.exe'
            - '\wallpaper32.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate user interaction with wallpaper scripts (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190
---
title: Interlock/Rhysida C2 Network Activity
id: b2c3d4e5-6789-01ab-cdef-234567890abc
description: Detects network connections to known Interlock/Rhysida infrastructure observed in OTX pulses.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a1b2c3d4e5f
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '185.196.9.234'
    selection_domain:
        DestinationDomain|contains:
            - 'leadslaw.com'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Cisco SD-WAN Webshell Upload Indicators
id: c3d4e5f6-7890-12ab-cdef-345678901bcd
description: Detects potential webshell upload or exploitation patterns associated with CVE-2026-20182 on Cisco SD-WAN infrastructure.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a1b2c3d4e5f
logsource:
    category: web
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'vpncomponent'
            - 'sslvpn'
    selection_methods:
        cs-method:
            - 'POST'
            - 'PUT'
    selection_ext:
        cs-uri-stem|endswith:
            - '.jsp'
            - '.php'
    condition: selection_uri and selection_methods and selection_ext
falsepositives:
    - Administrative management activities
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.20182


kql
// Hunt for connections to known malicious infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("185.196.9.234") 
   or RemoteUrl contains "leadslaw.com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl

// Hunt for file hashes associated with Gremlin and Vidar
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName


powershell
# IOC Hunt Script for Steam Wallpaper Droppers
# Searches User Profiles for specific RAR archives and suspicious executable hashes

$MaliciousHashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"
)

Write-Host "[+] Scanning for Steam Workshop Droppers and Malicious Binaries..."

# Check for Wallpaper Engine directories (common install path)
$SteamPaths = @("${env:ProgramFiles(x86)}\Steam", "$env:LOCALAPPDATA\Steam")

foreach ($Path in $SteamPaths) {
    if (Test-Path $Path) {
        Write-Host "[!] Found Steam installation at: $Path"
        # Scan for .rar files in workshop or download directories
        Get-ChildItem -Path $Path -Filter *.rar -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "[WARNING] Suspicious RAR found: $($_.FullName)"
        }
    }
}

# Scan User Profiles for specific hashes
Get-ChildItem -Path "C:\Users" -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object {
    $MaliciousHashes -contains $_.Hash
} | ForEach-Object {
    Write-Host "[CRITICAL] Malicious file detected: $($_.Path) | Hash: $($_.Hash)"
}