SessionGate, RemusStealer, PCPJack & APT37 Supply Chain: OTX Pulse Analysis — Enterprise Detection Pack

Recent OTX pulses have unveiled a convergence of high-threat activity ranging from financially motivated malware ecosystems to state-sponsored supply-chain compromises. The data highlights a sophisticated Malware Distribution System (TDS) impersonating popular open-source tools to distribute SessionGate, RemusStealer, and AnimateClipper. Simultaneously, the PCPJack actor has compromised hundreds of cloud servers to establish a covert SMTP relay network, and APT37 (ScarCruft) has leveraged a compromised gaming platform to deliver the BirdCall backdoor. These campaigns demonstrate a heavy reliance on trusted infrastructure abuse and supply-chain manipulation to bypass traditional security controls.

Threat Summary

The intelligence gathered reveals three distinct but concerning trends:

1. SEO Poisoning & TDS Ecosystems: Adversaries are impersonating legitimate tools (Ghidra, dnSpy) with high-ranking, professional websites. These sites use CloudFront-hosted JavaScript to hijack download button clicks, redirecting victims through a strict Traffic Distribution System (TDS). This TDS enforces anti-bot checks and state gating before delivering payloads like SessionGate and RemusStealer, primarily targeting users in Brazil, France, Germany, Poland, Russia, and the UK.

2. Cloud Infrastructure Abuse for Criminal Infrastructure: The PCPJack threat actor has systematically compromised 230 Linux servers across AWS, GCP, and Azure. These compromised instances are not used for cryptomining or data exfiltration in the traditional sense but are repurposed into a hidden SMTP relay network. This infrastructure is designed to facilitate email-based attacks while bypassing reputation-based filtering.

3. Targeted Supply-Chain Attacks: In a highly targeted operation, APT37 compromised a legitimate gaming platform dedicated to the Yanbian Korean region. By trojanizing both Windows and Android clients, they deployed the BirdCall backdoor and ROKRAT, specifically aiming at ethnic Koreans in China, likely for espionage purposes.

Threat Actor / Malware Profile

Malware Distribution Ecosystem (SessionGate, RemusStealer, AnimateClipper)

• Distribution Method: SEO poisoning and typosquatting of popular developer tools. Fake sites deliver a CloudFront JavaScript payload that redirects clicks to a TDS.
• Payload Behavior:
  • RemusStealer: An infostealer targeting cryptocurrency wallets and browser data.
  • SessionGate: Malware focused on session hijacking.
  • AnimateClipper: A cryptocurrency clipper that replaces clipboard wallet addresses with the attacker's address during transactions.
• C2 Communication: Specific C2 infrastructure details are obscured by the TDS, but indicators suggest the use of specific domains and IPs (e.g., guiformat.com, 194.150.220.218).
• Persistence: Typically achieved through malicious scripts or scheduled tasks established post-download.

PCPJack

• Actors: Likely a sophisticated cybercrime group (TeamPCP).
• Infrastructure: Uses compromised cloud servers running Linux.
• Payload/Tools: Deploys Chisel (a fast TCP tunnel over SSH) for proxying and Sliver C2 beacons for command and control.
• Objective: Creation of a massive, distributed SMTP relay network to send spam/phishing emails with high deliverability.

APT37 (ScarCruft)

• Actors: North Korea-aligned APT group.
• Distribution: Supply-chain compromise via a legitimate Yanbian-themed gaming platform.
• Payload Behavior:
  • BirdCall: A custom backdoor used for initial access and command execution.
  • ROKRAT: A well-known APT37 RAT used for data exfiltration and further lateral movement.
• Targeting: Highly specific, focusing on the Yanbian Korean community in China, a region sensitive to North Korean interests.

IOC Analysis

The provided indicators span multiple categories, requiring a multi-layered detection and blocking strategy:

• Domains & URLs (e.g., guiformat.com, 1980food.co.kr): These are critical for blocking at the DNS and Proxy level. The guiformat.com domain is part of the impersonation campaign, while 1980food.co.kr is associated with the APT37 C2. SOC teams should immediately add these to DNS sinkholes and web proxy block lists.
• IP Addresses (e.g., 194.150.220.218, 213.136.80.73): These IPs host the malicious RTF files and exposed PCPJack toolkits. Firewall rules should block all ingress/egress traffic to these IPs.
• File Hashes (SHA256, SHA1, MD5): A list of malicious samples is provided (e.g., 87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886). EDR solutions should be configured to quarantine files matching these hashes on sight.
• CVE (CVE-2021-4034): This "PwnKit" vulnerability is likely the initial access vector for the PCPJack cloud compromises. Vulnerability management teams must prioritize patching this specific CVE on all Linux endpoints.

Detection Engineering

Sigma Rules

---
title: Potential RemusStealer or SessionGate Execution
id: 12345678-1234-1234-1234-123456789012
description: Detects potential execution of RemusStealer or SessionGate based on process patterns often associated with these stealers or their downloaders.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1a9b9e247c1f6c5b4e9e
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    selection_cli:
        CommandLine|contains:
            - 'downloadString'
            - 'iex'
            - 'Invoke-Expression'
            - 'FromBase64String'
    selection_suspicious_urls:
        CommandLine|contains:
            - 'guiformat.com'
            - 'baxe.pics'
            - 'buccstanor.pics'
            - 'forestoaker.com'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: PCPJack Cloud Server Compromise Indicator
id: 87654321-4321-4321-4321-210987654321
description: Detects network connections or file artifacts associated with PCPJack activity on cloud Linux servers.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1a9b9e247c1f6c5b4e9f
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: linux
detection:
    selection_ip:
    - DestinationIp|startswith: '194.150.220.'
    - DestinationIp|startswith: '213.136.80.'
    selection_chisel:
        DestinationPort: 8080 # Chisel default HTTP proxy port
        Image|endswith: '/chisel'
    selection_sliver:
        Image|endswith: '/sliver'
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of chisel for network tunneling
level: critical
---
title: APT37 BirdCall and ROKRAT Supply Chain Payloads
id: abcdefgh-5678-5678-5678-567856785678
description: Detects file creation and process execution patterns associated with APT37's BirdCall and ROKRAT malware, delivered via a compromised gaming platform.
status: experimental
date: 2026/07/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1a9b9e247c1f6c5b4ea0
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: file_event
    product: windows
detection:
    selection_h:
        TargetFilename|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    selection_hashes:
        Hashes|contains:
            - '21ca0287ec5eaee8fb2f5d0542e378267d6ca0a6'
            - '2c6cc71b7e7e4b28c2c176b504bc5bdb687c4d41'
            - '5b70453ab58824a65ed0b6175c903aa022a87d6a'
            - '7331602726f61959d8f0e7820d457370'
    selection_domain:
        TargetFilename|contains: '1980food.co.kr'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: critical

KQL (Microsoft Sentinel)

// Hunt for network connections to known malicious domains/IPs from the pulses
DeviceNetworkEvents
| where RemoteUrl in ("guiformat.com", "forestoaker.com", "1980food.co.kr") 
   or RemoteIP has_prefix ("194.150.220.", "213.136.80.")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize count() by bin(Timestamp, 1h), DeviceName, RemoteUrl
| render timechart

PowerShell Hunt Script

# IOC Hunt Script for SessionGate, PCPJack, and APT37 Activity
# Run with administrator privileges

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

$MaliciousHashes = @(
    "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886",
    "21ca0287ec5eaee8fb2f5d0542e378267d6ca0a6",
    "2c6cc71b7e7e4b28c2c176b504bc5bdb687c4d41",
    "5b70453ab58824a65ed0b6175c903aa022a87d6a",
    "d9a369e328ea4f1b8304b6e11b50275f798e9d6b",
    "f9f6c0184cee9c1e4e15c2a73e56d7b927ea685b",
    "7331602726f61959d8f0e7820d457370",
    "03e3ece9f48cf4104aafc535790ca2fb3c6b26cf"
)

$MaliciousDomains = @(
    "guiformat.com",
    "forestoaker.com",
    "1980food.co.kr",
    "baxe.pics",
    "buccstanor.pics"
)

# Check for malicious files
Write-Host "Checking for malicious files..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { 
    $MaliciousHashes -contains $_.Hash 
} | Select-Object FullName, Length | Format-Table -AutoSize

# Check for suspicious network connections (needs admin rights)
Write-Host "Checking for active network connections to malicious domains..." -ForegroundColor Yellow
Get-NetTCPConnection | Where-Object { 
    $OwningProcess = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($OwningProcess) {
        $OwningProcess.ProcessName -in ("powershell", "cmd", "chrome", "firefox", "msedge")
    }
} | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Format-Table -AutoSize

# Check for DNS cache entries
Write-Host "Checking DNS cache for malicious domains..." -ForegroundColor Yellow
Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } | Select-Object Entry, Data | Format-Table -AutoSize

Write-Host "Hunt complete." -ForegroundColor Green

Response Priorities

Immediate (0-24 Hours)

1. Block Indicators of Compromise (IOCs): Immediately block all listed domains, URLs, and IP addresses at the firewall, proxy, and DNS layers. This is the most effective immediate containment step.
2. Scan for Malicious Files: Use EDR capabilities to scan all endpoints for the provided file hashes.
3. Patch Critical Vulnerability: Prioritize patching CVE-2021-4034 (PwnKit) on all Linux servers to prevent PCPJack compromise.

24 Hours

1. Credential Auditing: Given the presence of RemusStealer and SessionGate, initiate forced password resets and multi-factor authentication (MFA) reviews for accounts that may have been active on infected machines.
2. Network Analysis: Conduct a hunt for any internal systems communicating with the identified C2 infrastructure or TDS endpoints.
3. Supply Chain Verification: For organizations using the targeted gaming platform or downloading developer tools, verify the integrity of the software and its source.

1 Week

1. Architectural Hardening: Implement a strict allow-list policy for software downloads. Encourage the use of internal, vetted software repositories or package managers.
2. Cloud Security Posture: Enhance monitoring of cloud infrastructure (AWS, GCP, Azure) for signs of unauthorized access or anomalous network activity, such as the creation of SMTP relays.
3. User Awareness: Conduct security awareness training focused on identifying fake software download sites and the risks of supply-chain attacks.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub