Back to Intelligence

Spring Ring Teams Vishing + EtherHiding Magecart + Gryxa AI-Built Toolkit: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
August 31, 2026
11 min read

Threat Summary

Three concurrent OTX pulses published on 2026-08-31 paint a picture of a criminal ecosystem that is simultaneously professionalizing its social engineering, hiding its infrastructure in plain sight, and lowering its own skill barrier with AI-assisted development.

Spring Ring is a coordinated voice-phishing (vishing) operation active between January and April 2026. Operators registered or abused external Microsoft Teams accounts to impersonate internal IT help desk staff, placing direct Teams calls to more than 150 employees across at least 10 companies. The objective was initial access: victims were coached into launching remote monitoring and management (RMM) tooling or custom malware. Advanced variants chained this access into PetitPotam-style NTLM relay attacks against domain controllers and deployed a PowerShell-based RAT — a clear path from a single phone call to full domain compromise.

The second pulse documents a Magecart card-skimming campaign abusing the EtherHiding technique. Attackers compromise WooCommerce, PrestaShop, Magento, and WordPress storefronts, inject a loader masquerading as Google Tag Manager, and stage second-stage skimming payloads inside Ethereum smart-contract storage. Because the blockchain is immutable and censorship-resistant, takedown of the payload host is effectively impossible; the operators rotate only the disposable loader domains (the style* cluster visible in the indicators).

The third pulse profiles Gryxa, a toolkit built largely by an AI coding agent at the direction of an operator with no development experience. Despite this, the actor ran operations across several hundred hosts. Gryxa relies on RMM-style client behavior and multiple persistence layers — scheduled tasks and Windows Event Subscription (WMI event subscriptions) — and its supporting infrastructure includes lookalike domains such as gryxa.com, seczio.com, sevrz.com, and wirbe.com with CDN and Linux-branded hostnames (cdn.wirbe.com, debian.seczio.com) designed to blend into legitimate traffic.

Collectively, the pulses reveal one converging tradecraft trend: abuse of trusted channels (Teams, GTM lookalikes, blockchain, legitimate-sounding infrastructure) to deliver payloads, then persistence through native Windows mechanisms that evade signature-based controls.

Threat Actor / Malware Profile

Spring Ring (Vishing → RMM → NTLM Relay → PowerShell RAT)

  • Distribution: Direct Microsoft Teams voice calls from external tenant accounts impersonating IT help desk. Victims are verbally walked through executing RMM installers or attacker-supplied scripts.
  • Payload behavior: Initial foothold via commercial RMM agents (AnyDesk/TeamViewer-class tooling) or custom malware; post-exploitation includes a PowerShell RAT for command execution and lateral movement.
  • Privilege escalation: PetitPotam (MS-EFSRPC coercion) to force domain controller authentication, relayed via NTLM relay to escalate to domain dominance.
  • C2: RMM vendor infrastructure and attacker VPS hosts — the eight IPv4 indicators (e.g., 5.181.3.106, 178.130.47.46, 80.66.72.215, 185.155.99.161) are consistent with bulletproof-hosted staging/C2.
  • Persistence: RMM agent auto-start services; RAT persistence via scripts and scheduled execution.
  • Anti-analysis: No files required for initial access (living off the victim's own compliance with a phone call); abuse of signed RMM binaries defeats application allowlisting assumptions.

Magecart / EtherHiding Skimmer

  • Distribution: Compromised e-commerce storefronts (primarily WooCommerce; also PrestaShop, Magento, WordPress) via plugin/theme vulnerabilities or stolen admin credentials.
  • Payload behavior: Client-side JavaScript loader disguised as Google Tag Manager; on checkout pages it fetches the real skimmer from Ethereum smart-contract storage, harvests card data, and exfiltrates to disposable domains.
  • C2: On-chain payload staging (EtherHiding) plus a large rotation of throwaway loader/exfil domains: styleranked.com, styleshort.com, styleussles.com, stylehailens.com, styleouresen.com, stylehersi.com, styleember.com, stylestyk.com (55 indicators total).
  • Persistence: Malicious script injected into site templates/database; survives until source code is cleaned.
  • Anti-analysis: Blockchain-staged payloads cannot be sinkholed or taken down; payload only renders on checkout paths and may fingerprint for analysis environments.

Gryxa Toolkit (AI-Assisted Development)

  • Distribution: RMM-client-style deployment; operator deceived an AI coding agent by claiming authorized testing.
  • Payload behavior: Multi-component Windows toolkit providing remote control across several hundred hosts.
  • Persistence: Scheduled tasks and Windows Event Subscription (WMI permanent event subscriptions) — two mechanisms frequently missed by EDR policies tuned only for Run keys and services.
  • C2: Custom domains (gryxa.com, seczio.com, sevrz.com, wirbe.com) with deceptive hostnames (cdn.wirbe.com, debian.seczio.com) mimicking content delivery and Linux update infrastructure; supporting IPs 144.172.107.56 and 209.145.55.189.
  • Anti-analysis: AI-generated code produces non-standard signatures; behavior-based detection is explicitly required (per the pulse's own tagging).

IOC Analysis

The pulse set contains two indicator classes, and they must be operationalized differently:

  • IPv4 addresses (10 total): VPS/bulletproof infrastructure tied to Spring Ring C2/staging and Gryxa operations. Push to firewall, proxy, and EDR network blocklists with a 30–90 day TTL — these are disposable and will rotate. Prioritize retroactive NetFlow/proxy log searches for the last 90 days, since the Spring Ring campaign window ran January–April 2026.
  • Domains/hostnames (57+ total): Two distinct families. The style* Magecart cluster is high-churn disposable infrastructure — block at DNS and web proxy, and hunt proxy logs for any HTTPS session to these hosts from endpoints (indicates a user visited a compromised store) and from web servers (indicates your own storefront may be injected). The Gryxa cluster (gryxa.com, seczio.com, sevrz.com, wirbe.com, plus cdn.wirbe.com and debian.seczio.com) should be treated as active C2 — any internal resolution or connection is a presumed-compromise event requiring host isolation.

Tooling for operationalization: ingest the full OTX pulse IOC lists via the OTX DirectConnect API or a TIP (OpenCTI, MISP) into your SIEM; use DNS RPZ or a protective DNS resolver for domain blocks; for the EtherHiding campaign, blockchain RPC tools (or public explorers) can decode the smart-contract storage to extract the skimmer payload and its exfil endpoints for additional indicator extraction. Enrich all IPs with ASN/passive DNS before blocking to avoid collateral impact on shared hosting.

Detection Engineering

YAML
---
title: Suspicious WMI Event Subscription Persistence (Gryxa Toolkit)
id: 7f3a1c2e-9b41-4d68-a2f1-gryxa0000001
status: experimental
description: Detects creation of WMI permanent event subscriptions used by the Gryxa toolkit for persistence. Attackers register EventFilter/CommandLineEventConsumer bindings to survive reboots without touching Run keys.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
references:
  - https://reliaquest.com/blog/threat-spotlight-gryxa-ai-built-toolkit
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmi:
    CommandLine|contains:
      - '__EventFilter'
      - 'CommandLineEventConsumer'
      - 'ActiveScriptEventConsumer'
      - 'root\\subscription'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\wmic.exe'
      - '\mofcomp.exe'
  condition: selection_wmi and selection_img
falsepositives:
  - Legitimate enterprise monitoring agents registering WMI subscriptions
level: high
tags:
  - attack.persistence
  - attack.t1546.003
---
title: PetitPotam-Style NTLM Coercion and Relay Precursor (Spring Ring)
id: 8a4b2d3f-0c52-5e79-b3g2-springring002
status: experimental
description: Detects EFSRPC coercion attempts and suspicious NTLM authentication patterns associated with PetitPotam abuse seen in Spring Ring intrusions following Teams vishing initial access.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
references:
  - https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
  selection_anomalous:
    IpAddress|contains:
      - '5.181.3.106'
      - '178.130.47.46'
      - '80.66.72.215'
      - '185.155.99.161'
      - '45.8.157.185'
      - '2.56.172.214'
      - '185.234.67.53'
      - '136.0.20.6'
  condition: selection_event and selection_anomalous
falsepositives:
  - None expected; NTLM logons sourced from known-bad external infrastructure are inherently malicious
level: critical
tags:
  - attack.credential_access
  - attack.t1187
  - attack.t1557.001
---
title: Scheduled Task Persistence with Encoded PowerShell (Gryxa / Spring Ring RAT)
id: 9b5c3e4g-1d63-6f80-c4h3-gryxa0000003
status: experimental
description: Detects scheduled task creation that launches encoded or download-cradle PowerShell, a shared persistence pattern of the Gryxa toolkit and the Spring Ring PowerShell RAT.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/sc'
  selection_payload:
    CommandLine|contains:
      - 'powershell'
      - '-enc'
      - '-encodedcommand'
      - 'downloadstring'
      - 'invoke-expression'
      - 'iex'
  condition: selection_schtasks and selection_payload
falsepositives:
  - Admin automation scripts; baseline known IT task names
level: high
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.execution
  - attack.t1059.001
KQL — Microsoft Sentinel / Defender
// OTX Pulse Hunt — 2026-08-31: Spring Ring C2, EtherHiding Magecart domains, Gryxa infrastructure
let BadIPs = dynamic(["5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6","144.172.107.56","209.145.55.189"]);
let BadDomains = dynamic(["styleranked.com","styleshort.com","styleussles.com","stylehailens.com","styleouresen.com","stylehersi.com","styleember.com","stylestyk.com","gryxa.com","seczio.com","sevrz.com","wirbe.com","cdn.wirbe.com","debian.seczio.com"]);
let NetHits = DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteIP in (BadIPs) or RemoteUrl has_any (BadDomains)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let DnsHits = DeviceEvents
| where Timestamp > ago(90d)
| where ActionType == "DnsQueryResponse"
| extend Query = tostring(parse_json(AdditionalFields).Query)
| where Query has_any (BadDomains)
| project Timestamp, DeviceName, Query, InitiatingProcessFileName;
let SuspiciousRMM = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("anydesk.exe","teamviewer.exe","teamviewer_service.exe","screenconnect.exe","rustdesk.exe","splashtop.exe")
| where InitiatingProcessFileName in~ ("powershell.exe","cmd.exe","explorer.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
union NetHits, SuspiciousRMM
| sort by Timestamp desc
PowerShell
# OTX Hunt Script — Spring Ring / Gryxa / EtherHiding artifacts
# Run elevated on suspect endpoints. Outputs findings to console and CSV.

$badIPs = @("5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6","144.172.107.56","209.145.55.189")
$badDomains = @("styleranked.com","styleshort.com","styleussles.com","stylehailens.com","styleouresen.com","stylehersi.com","styleember.com","stylestyk.com","gryxa.com","seczio.com","sevrz.com","wirbe.com","cdn.wirbe.com","debian.seczio.com")
$findings = @()

# 1. Active and historical network connections to known C2 IPs
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $findings += [pscustomobject]@{ Type='NetworkConnection'; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] OwningPID=$($_.OwningProcess)" }
}

# 2. DNS client cache for malicious domains
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
    $findings += [pscustomobject]@{ Type='DNSCache'; Detail="$($_.Entry) -> $($_.Data)" }
}

# 3. Scheduled tasks launching PowerShell / suspicious binaries (Gryxa + Spring Ring RAT persistence)
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $task = $_
    $task.Actions | Where-Object { $_.Execute -match 'powershell|pwsh|cmd|wscript|mshta|rundll32|regsvr32' -or $_.Arguments -match '-enc|downloadstring|iex|http' } | ForEach-Object {
        $findings += [pscustomobject]@{ Type='ScheduledTask'; Detail="$($task.TaskPath)$($task.TaskName) :: $($_.Execute) $($_.Arguments)" }
    }
}

# 4. WMI permanent event subscriptions (Gryxa persistence)
try {
    Get-WmiObject -Namespace root\subscription -Class __EventFilter -ErrorAction Stop | ForEach-Object {
        $findings += [pscustomobject]@{ Type='WMIEventFilter'; Detail="Name=$($_.Name) Query=$($_.Query)" }
    }
    Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer -ErrorAction Stop | ForEach-Object {
        $findings += [pscustomobject]@{ Type='WMIConsumer'; Detail="Name=$($_.Name) Cmd=$($_.CommandLineTemplate)" }
    }
    Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding -ErrorAction Stop | ForEach-Object {
        $findings += [pscustomobject]@{ Type='WMIBinding'; Detail="Filter=$($_.Filter) Consumer=$($_.Consumer)" }
    }
} catch { }

# 5. RMM tooling installed/services (Spring Ring initial access)
$rmmNames = 'anydesk','teamviewer','screenconnect','connectwise','rustdesk','splashtop','atera','ninja','zoho'
Get-Service -ErrorAction SilentlyContinue | Where-Object { $s = $_.Name + $_.DisplayName; $rmmNames | Where-Object { $s -match $_ } } | ForEach-Object {
    $findings += [pscustomobject]@{ Type='RMMService'; Detail="$($_.Name) [$($_.Status)] — verify business justification" }
}

# 6. NTLM relay exposure check on this host ( PetitPotam / relay hardening audit )
$lsa = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -ErrorAction SilentlyContinue
$findings += [pscustomobject]@{ Type='ConfigAudit'; Detail="LmCompatibilityLevel=$($lsa.LmCompatibilityLevel) (recommend 5 = refuse LM/NTLM)" }

if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\otx_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) finding(s). Investigate Type=NetworkConnection or WMI* immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators of Spring Ring, Gryxa, or EtherHiding infrastructure found on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0–4 hours):

  • Block all 10 IPv4 indicators at the perimeter firewall, web proxy, and EDR network layer; block all 57+ domains via protective DNS/RPZ and proxy category overrides.
  • Run the KQL hunt across the last 90 days. Any hit on Gryxa infrastructure (gryxa.com, seczio.com, sevrz.com, wirbe.com, 144.172.107.56, 209.145.55.189) is a presumed compromise — isolate the host and begin IR.
  • Inventory installed RMM tools enterprise-wide; flag any agent without a documented business owner, especially on machines whose users report recent "IT support" Teams calls.
  • If you operate an e-commerce storefront: grep templates, themes, and database-stored blocks for unexpected GTM-like script tags and references to the style* domain pattern.

24 hours:

  • For any user contacted by Spring Ring impersonators or who executed RMM tooling: force credential reset, revoke all sessions/tokens, and review their authentication logs for anomalous NTLM and remote logons. Because the campaign chains into NTLM relay against domain controllers, audit DC security logs (Event 4624, NTLMv1, unsigned sessions) and assume credential theft for any host showing C2 contact.
  • Enable or verify SMB signing and LDAP signing/channel binding on all DCs; disable NTLMv1 domain-wide if not already done.
  • Reset credentials for any e-commerce admin accounts and rotate payment-gateway API keys if storefront injection is found.

1 week:

  • Architecture hardening against the attack vectors: restrict or disable external Teams federation/unsolicited external calls where business-feasible, or banner-warn users on external calls; deploy an application allowlisting policy that constrains RMM binaries to an approved list; enable WMI subscription and scheduled-task creation auditing (and forward to SIEM); enforce Extended Protection for Authentication and SMB signing to break PetitPotam/NTLM relay chains.
  • For web properties: implement Subresource Integrity and Content Security Policy on checkout pages, and deploy client-side script-integrity monitoring to catch injected skimmer loaders regardless of whether the payload is staged on-chain (EtherHiding defeats infrastructure takedown — detection must happen at the browser layer).
  • Add behavior-based detections (the three Sigma rules above) to production; Gryxa-style AI-generated tooling will not match legacy signatures.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-malwarespring-ring-vishingetherhiding-magecartgryxa-toolkitmicrosoft-teams-abusecard-skimming

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action