ShinyHunters OAuth Abuse + DarkHotel North Korea Lures + Jewelbug Antino Backdoor: OTX Pulse Analysis — Enterprise Detection Pack

---
title: DarkHotel MSI Installer Spawning PowerShell Shellcode Loader
id: 9f2a1c7e-3b41-4d5e-8a6f-darhotel0001
status: experimental
description: Detects msiexec spawning PowerShell, consistent with DarkHotel APT-C-06 trojanized MSI installers deploying ChaCha20-encrypted shellcode (OTX pulse 2026-08-13)
author: Security Arsenal Threat Intelligence
references:
  - https://mp.weixin.qq.com/s/KrQyZ2AZn9dcL3Fqyg_y3Q
date: 2026/08/13
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1218.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\msiexec.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'FromBase64String'
      - 'Invoke-Expression'
      - 'IEX'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Legitimate software deployment tools wrapping PowerShell post-install scripts
level: high
---
title: Scheduled Task Persistence via MSI or Script Interpreter Child Process
id: 7c1e4b22-9a05-4f77-b312-darksched002
status: experimental
description: Detects scheduled task creation by script interpreters or installer processes, matching DarkHotel persistence tradecraft observed in the April 2026 North Korea lure campaign
author: Security Arsenal Threat Intelligence
references:
  - https://mp.weixin.qq.com/s/KrQyZ2AZn9dcL3Fqyg_y3Q
date: 2026/08/13
tags:
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\schtasks.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cmd:
    CommandLine|contains:
      - '/create'
      - 'Register-ScheduledTask'
      - 'New-ScheduledTask'
  filter_system:
    ParentImage|endswith: '\TiWorker.exe'
  condition: selection_img and selection_cmd and not filter_system
falsepositives:
  - Software installation routines; enterprise GPO task deployment
level: medium
---
title: Jewelbug Antino Backdoor C2 Communication
id: 4d8f0a13-2e6b-4c91-a550-jewelc20003
status: experimental
description: Detects network connections to known Jewelbug (REF7707) XG-Web / Antino backdoor command-and-control infrastructure
author: Security Arsenal Threat Intelligence
references:
  - https://www.security.com/blog-post/jewelbug-crypto-fraud-espionage
date: 2026/08/13
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp: '38.12.1.47'
  selection_dns:
    QueryName|contains:
      - 'jkskhei.com'
      - '3jkg8d.com'
  condition: 1 of selection_*
falsepositives:
  - Threat researcher sandbox detonation
level: critical

// Jewelbug + DarkHotel C2 and DNS retro-hunt (Microsoft Sentinel)
// Covers Antino backdoor C2, DarkHotel staging, and related DNS resolution
let KnownC2IPs = dynamic(["38.12.1.47"]);
let KnownC2Domains = dynamic(["jkskhei.com", "3jkg8d.com", "built.3jkg8d.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in (KnownC2IPs)
   or RemoteUrl has_any (KnownC2Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let DnsHits = DeviceEvents
| where TimeGenerated > ago(90d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(parse_json(AdditionalFields).DnsQueryString)
| where QueryName has_any (KnownC2Domains)
| project TimeGenerated, DeviceName, QueryName, InitiatingProcessFileName;
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where InitiatingProcessFileName =~ "msiexec.exe"
   and FileName has_any ("powershell.exe", "pwsh.exe")
   and ProcessCommandLine has_any ("-enc", "FromBase64String", "Invoke-Expression")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256;
union NetHits, DnsHits, ProcessHits
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt — DarkHotel + Jewelbug artifacts
# Checks scheduled tasks, network connections, DNS cache, and file hashes
# Run elevated on suspect endpoints or via your RMM/EDR remote shell

$Report = @()

# --- 1. DarkHotel persistence: anomalous scheduled tasks ---
$SuspectTasks = Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike '\Microsoft*' -and
    ($_.Actions.Execute -match 'powershell|wscript|cscript|msiexec|rundll32')
}
foreach ($t in $SuspectTasks) {
    $Report += [PSCustomObject]@{
        Check   = 'ScheduledTask'
        Finding = "$($t.TaskName) -> $($t.Actions.Execute) $($t.Actions.Arguments)"
        Risk    = 'Review'
    }
}

# --- 2. Jewelbug / DarkHotel C2: active and historical network indicators ---
$BadIPs = @('38.12.1.47')
$Conns = Get-NetTCPConnection -ErrorAction SilentlyContinue |
    Where-Object { $BadIPs -contains $_.RemoteAddress }
foreach ($c in $Conns) {
    $Report += [PSCustomObject]@{
        Check   = 'NetworkConnection'
        Finding = "PID $($c.OwningProcess) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"
        Risk    = 'CRITICAL'
    }
}

# --- 3. DNS cache evidence of C2 resolution ---
$BadDomains = @('jkskhei.com', '3jkg8d.com')
$DnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $d = $_.Name; $BadDomains | Where-Object { $d -like "*$_*" } }
foreach ($h in $DnsHits) {
    $Report += [PSCustomObject]@{
        Check   = 'DNSCache'
        Finding = "$($h.Name) -> $($h.Data)"
        Risk    = 'CRITICAL'
    }
}

# --- 4. File hash sweep (common staging locations) ---
$BadHashes = @(
    'e6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcf',
    '01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a',
    'e809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34',
    'f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8',
    'e2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530'
)
$ScanPaths = @("$env:TEMP", "$env:APPDATA", "$env:ProgramData", "C:\Users\Public")
foreach ($p in $ScanPaths) {
    Get-ChildItem -Path $p -Recurse -File -Include *.msi,*.exe,*.dll -ErrorAction SilentlyContinue |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($BadHashes -contains $h.ToLower()) {
                $Report += [PSCustomObject]@{
                    Check   = 'FileHash'
                    Finding = "$($_.FullName) [SHA256 match]"
                    Risk    = 'CRITICAL'
                }
            }
        }
}

$Report | Format-Table -AutoSize
if ($Report | Where-Object Risk -eq 'CRITICAL') {
    Write-Host '[!] CRITICAL findings — isolate host and escalate to IR immediately.' -ForegroundColor Red
} else {
    Write-Host '[+] No critical IOC matches found on this host.' -ForegroundColor Green
}