Silent Lynx Espionage Cluster + Plex CVE-2026-9665x Exploitation Chain: OTX Pulse Analysis — Central Asia APT & Mass Cryptominer Detection Pack

---
title: Silent Lynx Tunneling and Post-Exploitation Tool Execution
id: 9f2a41c7-3b6e-4d1a-8c52-7e1f0a9b5d31
status: experimental
description: Detects execution of Ligolo-ng tunneling, Meterpreter, or Cobalt Strike loader artifacts associated with Silent Lynx intrusions against CIS government and energy targets.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
    - https://www.virusbulletin.com/uploads/pdf/conference/vb2026/papers/Break-the-silence-tracking-Silent-Lynx-through-exposed-infrastructure.pdf
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\ligolo-ng.exe'
            - '\ligolo-agent.exe'
            - '\ligolo-proxy.exe'
    selection_cmd:
        CommandLine|contains:
            - 'ligolo'
            - '-connect '
            - 'pickleshell'
            - 'ssdpshell'
    condition: selection_img or selection_cmd
falsepositives:
    - Legitimate red team or penetration testing activity using Ligolo-ng
level: high
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.t1059
---
title: Silent Lynx C2 Infrastructure Communication
id: 1c7b8e44-2a5f-4f39-9d61-3a0c6b8e2f77
status: experimental
description: Detects network connections to known Silent Lynx C2 IPv4 addresses and DDNS hostnames identified in OTX pulse BREAK THE SILENCE.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
    - https://www.virusbulletin.com/uploads/pdf/conference/vb2026/papers/Break-the-silence-tracking-Silent-Lynx-through-exposed-infrastructure.pdf
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '46.17.42.29'
            - '185.125.203.150'
            - '154.18.187.239'
            - '89.22.169.22'
    selection_dns:
        DestinationHostname|contains:
            - 'cs.access.ly'
            - 'toolbox.ddns.net'
            - 'q1q.ddns.net'
            - 'repo-centos-webstatic-world.securitytactics.com'
    condition: selection_ip or selection_dns
falsepositives:
    - Unlikely; infrastructure is attributed to espionage C2
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1568
---
title: Plex Exploitation XMRig Cryptominer or Proxy Implant Deployment
id: 6d3e9a01-8f4c-4b27-b1e5-2d9a0c7f4e12
status: experimental
description: Detects child processes spawning from Plex Media Server consistent with CVE-2026-9665x RCE exploitation deploying XMRig or myawesomeproxy payloads.
author: Security Arsenal Threat Intelligence
date: 2026/10/20
references:
    - https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Plex Media Server.exe'
            - '\PlexMediaServer.exe'
            - '\Plex Script Host.exe'
    selection_child_suspicious:
        Image|endswith:
            - '\xmrig.exe'
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\curl.exe'
            - '\wget.exe'
            - '\bash.exe'
            - '\sh.exe'
    condition: selection_parent and selection_child_suspicious
falsepositives:
    - Plex Script Host executing legitimate plugin scripts (rare for cmd/powershell)
level: critical
tags:
    - attack.execution
    - attack.t1190
    - attack.impact
    - attack.t1496

// Hunt: Silent Lynx C2 egress + Plex exploitation process anomalies (last 14 days)
let SilentLynxIPs = dynamic(["46.17.42.29", "185.125.203.150", "154.18.187.239", "89.22.169.22", "217.60.194.116"]);
let SilentLynxDomains = dynamic(["cs.access.ly", "toolbox.ddns.net", "q1q.ddns.net", "repo-centos-webstatic-world.securitytactics.com"]);
let PlexHashes = dynamic(["b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49", "e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22", "343427f5c7d42fe23a2b8e31e37168c2"]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (SilentLynxIPs) or RemoteUrl has_any (SilentLynxDomains)
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
    | extend HuntHit = "SilentLynx-C2"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where (InitiatingProcessFileName has_any ("Plex Media Server", "PlexMediaServer")
             and FileName in~ ("cmd.exe", "powershell.exe", "xmrig.exe", "certutil.exe", "curl.exe", "wget.exe"))
            or SHA256 in (PlexHashes) or MD5 in (PlexHashes)
    | summarize Executions=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, FileName, ProcessCommandLine, SHA256
    | extend HuntHit = "Plex-Exploit-Payload"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("ligolo", "stratum+tcp", "myawesomeproxy")
    | summarize Executions=count(), FirstSeen=min(TimeGenerated) by DeviceName, FileName, ProcessCommandLine
    | extend HuntHit = "Tunneling-or-Miner-CLI"
    )
| sort by FirstSeen asc

# Security Arsenal — OTX IOC Hunt: Silent Lynx + Plex/XMRig Artifacts
# Run elevated on suspected hosts. Outputs findings to console and CSV.

$findings = @()

# 1) Network connections to known C2 / exploitation infrastructure
$c2IPs = @("46.17.42.29","185.125.203.150","154.18.187.239","89.22.169.22","217.60.194.116")
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $c2IPs -contains $_.RemoteAddress
} | ForEach-Object {
    $findings += [pscustomobject]@{
        Type = "Network-C2"
        Detail = "$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] PID=$($_.OwningProcess)"
    }
}

# 2) DNS cache hits for DDNS / staging domains
$badDomains = @("cs.access.ly","toolbox.ddns.net","q1q.ddns.net","securitytactics.com")
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Entry; $badDomains | Where-Object { $n -like "*$_*" }
} | ForEach-Object {
    $findings += [pscustomobject]@{ Type = "DNS-Cache"; Detail = "$($_.Entry) -> $($_.Data)" }
}

# 3) Persistence: Run keys referencing tunneling/mining tooling
$runPaths = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
              "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($p in $runPaths) {
    Get-ItemProperty $p -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match "ligolo|xmrig|myawesomeproxy|meterpreter|pickleshell|ssdpshell"
        } | ForEach-Object {
            $findings += [pscustomobject]@{ Type = "Persistence-RunKey"; Detail = "$p :: $($_.Name) = $($_.Value)" }
        }
    }
}

# 4) Scheduled tasks masquerading as updater/maintenance
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute + " " + $_.Actions.Arguments) -match "ligolo|xmrig|myawesomeproxy|stratum"
} | ForEach-Object {
    $findings += [pscustomobject]@{ Type = "Persistence-ScheduledTask"; Detail = "$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }
}

# 5) Payload hash sweep of common staging directories
$targetHashes = @("b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49",
                  "e4593f7938e76dfb40a3fe5358dfae231ef539a02ef3fda35bbccd6d2b7cdc22")
$searchDirs = @("$env:TEMP","$env:ProgramData","C:\Users\Public","$env:LOCALAPPDATA\Plex Media Server")
foreach ($dir in $searchDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($targetHashes -contains $h.ToLower())) {
                $findings += [pscustomobject]@{ Type = "Hash-Match-XMRig"; Detail = "$($_.FullName) [$h]" }
            }
        }
    }
}

if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\otx_hunt_findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) potential IOC hits found — isolate host and escalate to IR." -ForegroundColor Red
} else {
    Write-Host "[+] No IOC artifacts detected on this host." -ForegroundColor Green
}