Runningcrab Supply Chain & LeakNet Ransomware: Speagle Infostealer, Deno Loaders & Telegram C2 Analysis

title: Potential Infostealer.Speagle C2 Traffic
id: 4e2b3f2c-5a6b-4c7d-8e9f-1a2b3c4d5e6f
description: Detects network connections indicative of Speagle infostealer C2 communication mimicking Cobra DocGuard diagnostics.
status: experimental
date: 2026/04/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61843a2f8a0c1c0f3c4d5e6f
tags:
    - attack.command_and_control
    - attack.exfiltration
logsource:
    category: network_connection
detection:
    selection:
        DestinationPort|startswith: '809'
        init: '|'
        DestinationHostname|contains:
            - 'CDGServer3'
        RequestURI|contains:
            - 'CDGClientDiagnostics'
            - 'syn_user_policy'
    condition: selection
falsepositives:
    - Legitimate Cobra DocGuard traffic (verify destination IP is not in threat intel)
level: high
---
title: Suspicious Telegram API Usage by Non-Browser Process
id: 5f3c4g2h-6b7c-8d9e-0f1a-2b3c4d5e6f7a
description: Detects potential Hydra Saiga C2 activity using Telegram Bot API from unusual processes.
status: experimental
date: 2026/04/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61843a2f8a0c1c0f3c4d5e6f
tags:
    - attack.command_and_control
    - detection.defense_evasion
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains: 'api.telegram.org'
    filter_legitimate:
        Image|endswith:
            - '\telegram.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\opera.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Third-party messaging clients or automation tools legitimately using Telegram API
level: medium
---
title: LeakNet Deno In-Memory Loader Execution
id: 6g4d5h3i-7c8d-9e0f-1a2b-3c4d5e6f7a8b
description: Detects the execution of Deno runtime which may be used by LeakNet for in-memory payload loading.
status: experimental
date: 2026/04/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61843a2f8a0c1c0f3c4d5e6f
tags:
    - attack.execution
    - attack.defense_evasion
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith: '\deno.exe'
        CommandLine|contains:
            - 'eval'
            - 'run'
            - 'fetch'
    condition: selection
falsepositives:
    - Legitimate developer usage of Deno JavaScript runtime
level: low

// Hunt for Speagle C2 and LeakNet ClickFix Domains
let IOCs = dynamic([
    "okobojirent.com", "mshealthmetrics.com", "serialmenot.com", "neremedysoft.com", 
    "cnoocim.com", "apiclofront.com", "crahdhduf.com", "delhedghogeggs.com",
    "allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", "wincorpupdates.com"
]);
// Network Events for Domains
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteUrl contains "CDGClientDiagnostics"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IOCHit = iff(RemoteUrl in (IOCs), "Domain", "Speagle Path")
| order by Timestamp desc
;
// Process Creation for Deno (LeakNet)
DeviceProcessEvents
| where FileName =~ "deno.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
;
// File Creation for Speagle Hashes
DeviceFileEvents
| where SHA256 in (
    "03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b",
    "d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877"
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName

# IOC Hunt for Speagle Hashes and Suspicious Network Connections
# Requires Admin Privileges

$speagleHashes = @(
    "03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b",
    "d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877",
    "dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d",
    "fad8d0307db5328c8b9f283a2cc6f7e4f4333001623fef5bd5c32a1c094bf890"
)

$suspiciousDomains = @(
    "okobojirent.com", "mshealthmetrics.com", "serialmenot.com", "neremedysoft.com",
    "cnoocim.com", "apiclofront.com", "crahdhduf.com", "delhedghogeggs.com",
    "allcloudindex.com", "docworldme.com", "pweobmxdlboi.com", "wincorpupdates.com"
)

Write-Host "[+] Checking for Speagle Malware File Hashes..." -ForegroundColor Cyan
$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($drive in $drives) {
    Write-Host "Scanning $drive..."
    Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($speagleHashes -contains $hash) {
            Write-Host "[!] MALWARE DETECTED: $($_.FullName) (Hash: $hash)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for Active Network Connections to Suspicious Domains..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection | Where-Object { $_.State -eq 'ESTABLISHED' }
foreach ($conn in $connections) {
    try {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction Stop
        $remoteIP = $conn.RemoteAddress
        $dnsEntry = Resolve-DnsName -Name $remoteIP -ErrorAction SilentlyContinue | 
                    Where-Object { $_.Type -eq 'A' } | 
                    Select-Object -ExpandProperty NameHost -ErrorAction SilentlyContinue
        
        if ($dnsEntry) {
            foreach ($domain in $suspiciousDomains) {
                if ($dnsEntry -like "*$domain*") {
                    Write-Host "[!] SUSPICIOUS CONNECTION: Process $($process.ProcessName) PID $($conn.OwningProcess) connected to $dnsEntry ($remoteIP)" -ForegroundColor Red
                }
            }
        }
    } catch {
        # Ignore errors accessing system processes
    }
}

Write-Host "[+] Checking for Deno Runtime (LeakNet Loader)..." -ForegroundColor Cyan
$denoProcess = Get-Process -Name "deno" -ErrorAction SilentlyContinue
if ($denoProcess) {
    Write-Host "[!] DENO PROCESS DETECTED: $($denoProcess.Path) PID $($denoProcess.Id)" -ForegroundColor Yellow
    Write-Host "    Verify if this is a legitimate developer tool." -ForegroundColor Gray
}