Storm-3075 AI Impersonation & SilabRAT MaaS Campaign: Multi-Vector Threat Analysis

---
title: Potential Vidar/Lumma Stealer Execution via Hijack Loader
id: 7f8a3c2d-1e4b-4a7f-9c6e-3d5f8a2b1c9d
description: Detects execution patterns associated with Hijack Loader delivering Vidar or Lumma Stealer, often via AI-themed lures
status: experimental
author: Security Arsenal
date: 2026/06/14
references:
    - https://otx.alienvault.com/pulse/ai-brands-as-bait/
tags:
    - attack.credential_access
    - attack.execution
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\\svchost.exe'
            - '\\explorer.exe'
        Image|endswith:
            - '\\\\temp\\'
            - '\\\\appdata\\local\\temp\\'
        CommandLine|contains:
            - '-enc'
            - '-w hidden'
            - 'powershell.exe -nop -w hidden -c'
    selection_loader:
        Image|contains:
            - 'Hijack'
            - 'Loader'
        Company|contains:
            - 'Unknown'
        OriginalFileName|contains:
            - 'hijack'
    condition: 1 of selection*
falsepositives:
    - Legitimate software installers using temp directories
level: high
---
title: SilabRAT Browser Profile Cloning Activity
id: 4e6d1a9c-2f3b-5d8e-7a4f-6c0e9b3d2a1e
description: Detects SQLite database access patterns consistent with browser profile cloning by SilabRAT
status: experimental
author: Security Arsenal
date: 2026/06/14
references:
    - https://otx.alienvault.com/pulse/silabrat-whats-your-power/
tags:
    - attack.credential_access
    - attack.collection
    - attack.t1005
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\\cookies.sqlite'
            - '\\logins.'
            - '\\history.sqlite'
            - '\\places.sqlite'
        Image|contains:
            - '\\AppData\\Roaming\\'
            - '\\AppData\\Local\\Temp\\'
    selection_process:
        ProcessName|endswith:
            - '.exe'
        Company:
            - 'Unknown'
        OriginalFileName|contains:
            - 'SilabRAT'
            - 'Hijack'
    filter_legit:
        Image|contains:
            - '\\Mozilla Firefox\\'
            - '\\Google\\Chrome\\'
            - '\\Microsoft\\Edge\\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate browser backup tools
level: critical
---
title: Cisco SD-WAN Vulnerability Exploitation Indicators
id: 5d7e2b1d-3g4c-6f9d-8b5g-7d1f0c4e3b2f
description: Detects potential exploitation of Cisco Catalyst SD-WAN vulnerabilities by UAT-8616
status: experimental
author: Security Arsenal
date: 2026/06/14
references:
    - https://otx.alienvault.com/pulse/cisco-sd-wan-exploitation/
tags:
    - attack.initial_access
    - attack.exploitation
    - attack.t1190
logsource:
    category: web
    product: firewall
detection:
    selection_cve:
        cs-method|contains:
            - 'POST'
        cs-uri-query|contains:
            - 'vpnportal'
            - 'sdwan'
            - 'vmanage'
    selection_webshell:
        cs-uri-query|contains:
            - 'XenShell'
            - 'Godzilla'
            - 'Behinder'
        sc-status:
            - 200
            - 500
    selection_exploit:
        cs-uri-query|contains:
            - '%2F..%2F'
            - 'path traversal'
            - 'authentication bypass'
    condition: 1 of selection*
falsepositives:
    - Legitimate SD-WAN management access
level: high


kql
// KQL Hunt for AI-themed credential theft activity
let Hashes = pack_array(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
);
let C2Domains = pack_array(
    "brokeapt.com",
    "rongtv.xyz",
    "ssffaa19.xyz"
);
let C2IPs = pack_array(
    "91.199.163.124"
);
// Process execution with known hashes
DeviceProcessEvents
| where SHA256 in~ Hashes
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, SHA256, InitiatingProcessFileName
| union (
    // Network connections to C2 infrastructure
    DeviceNetworkEvents
    | where RemoteUrl in~ C2Domains or RemoteIP in~ C2IPs
    | project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName
)
| union (
    // File creation related to AI-themed lures
    DeviceFileEvents
    | where FileName contains "AI" or FolderPath contains "AI" or InitiatingProcessFileName contains "AI"
    | project Timestamp, DeviceName, AccountName, FileName, SHA256, InitiatingProcessFileName
)
| order by Timestamp desc


powershell
# PowerShell Hunt Script for Vidar/Lumma Stealer and SilabRAT Indicators
# Run as Administrator

$ErrorActionPreference = "SilentlyContinue"

# Known malicious hashes from OTX pulses
$MaliciousHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)

# C2 infrastructure
$MaliciousDomains = @(
    "brokeapt.com",
    "rongtv.xyz",
    "ssffaa19.xyz"
)

$MaliciousIPs = @(
    "91.199.163.124"
)

# Suspicious process paths
$SuspiciousPaths = @(
    "C:\\Program Files\\AIUpdate",
    "$env:APPDATA\\AIUpdate",
    "$env:TEMP\\hijack"
)

# Suspicious scheduled task names
$SuspiciousTasks = @(
    "AIUpdate",
    "WindowsUpdateService"
)

# Registry persistence locations
$PersistenceKeys = @(
    "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
    "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AIUpdate"
)

Write-Host "[+] Starting IOC Hunt for Storm-3075 and SilabRAT Activity..." -ForegroundColor Cyan

# Check for malicious processes
Write-Host "\n[*] Checking for running malicious processes..." -ForegroundColor Yellow
$Processes = Get-Process | Where-Object {$_.Path -ne $null}
$MaliciousProcesses = @()
foreach ($Process in $Processes) {
    $Hash = (Get-FileHash -Path $Process.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($Hash -in $MaliciousHashes) {
        $MaliciousProcesses += $Process
    }
}

if ($MaliciousProcesses.Count -gt 0) {
    Write-Host "[!] ALERT: Found $($MaliciousProcesses.Count) malicious processes:" -ForegroundColor Red
    $MaliciousProcesses | Format-Table Id, ProcessName, Path -AutoSize
} else {
    Write-Host "[-] No malicious processes found" -ForegroundColor Green
}

# Check for suspicious files
Write-Host "\n[*] Checking for suspicious files..." -ForegroundColor Yellow
$SuspiciousFiles = @()
foreach ($Path in $SuspiciousPaths) {
    if (Test-Path $Path) {
        $Files = Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue
        foreach ($File in $Files) {
            $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $MaliciousHashes) {
                $SuspiciousFiles += $File
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Host "[!] ALERT: Found $($SuspiciousFiles.Count) suspicious files:" -ForegroundColor Red
    $SuspiciousFiles | Format-Table FullName, Length, LastWriteTime -AutoSize
} else {
    Write-Host "[-] No suspicious files found" -ForegroundColor Green
}

# Check for scheduled tasks
Write-Host "\n[*] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
$SuspiciousScheduledTasks = Get-ScheduledTask | Where-Object {$SuspiciousTasks -contains $_.TaskName}
if ($SuspiciousScheduledTasks) {
    Write-Host "[!] ALERT: Found suspicious scheduled tasks:" -ForegroundColor Red
    $SuspiciousScheduledTasks | Format-Table TaskName, State, Author -AutoSize
} else {
    Write-Host "[-] No suspicious scheduled tasks found" -ForegroundColor Green
}

# Check registry persistence
Write-Host "\n[*] Checking registry persistence..." -ForegroundColor Yellow
$PersistenceFound = $false
foreach ($Key in $PersistenceKeys) {
    if (Test-Path $Key) {
        $Value = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
        if ($Value) {
            Write-Host "[!] ALERT: Persistence key found at $Key" -ForegroundColor Red
            $Value | Format-List
            $PersistenceFound = $true
        }
    }
}
if (-not $PersistenceFound) {
    Write-Host "[-] No registry persistence found" -ForegroundColor Green
}

# Check DNS cache for C2 domains
Write-Host "\n[*] Checking DNS cache for C2 domains..." -ForegroundColor Yellow
$DNSEntries = Get-DnsClientCache | Where-Object {$MaliciousDomains -contains $_.Entry}
if ($DNSEntries) {
    Write-Host "[!] ALERT: Found C2 domain DNS entries:" -ForegroundColor Red
    $DNSEntries | Format-Table Entry, Data, Status -AutoSize
} else {
    Write-Host "[-] No C2 domain DNS entries found" -ForegroundColor Green
}

# Check network connections to C2 IPs
Write-Host "\n[*] Checking network connections to C2 IPs..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection | Where-Object {$MaliciousIPs -contains $_.RemoteAddress}
if ($Connections) {
    Write-Host "[!] ALERT: Found connections to C2 IPs:" -ForegroundColor Red
    $Connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State -AutoSize
} else {
    Write-Host "[-] No connections to C2 IPs found" -ForegroundColor Green
}

# Check browser profile access (SilabRAT indicator)
Write-Host "\n[*] Checking for browser profile access (SilabRAT)..." -ForegroundColor Yellow
$BrowserPaths = @(
    "$env:APPDATA\\Mozilla\\Firefox\\Profiles",
    "$env:LOCALAPPDATA\\Google\\Chrome\\User Data",
    "$env:LOCALAPPDATA\\Microsoft\\Edge\\User Data"
)
$SuspiciousAccess = $false
foreach ($Path in $BrowserPaths) {
    if (Test-Path $Path) {
        $RecentAccess = Get-ChildItem -Path $Path -Recurse -Include "cookies.sqlite","logins." -ErrorAction SilentlyContinue |
            Where-Object {$_.LastAccessTime -gt (Get-Date).AddHours(-24)}
        if ($RecentAccess) {
            Write-Host "[!] ALERT: Recent browser profile access detected at $Path" -ForegroundColor Red
            $RecentAccess | Format-Table FullName, LastAccessTime -AutoSize
            $SuspiciousAccess = $true
        }
    }
}
if (-not $SuspiciousAccess) {
    Write-Host "[-] No suspicious browser profile access found" -ForegroundColor Green
}

Write-Host "\n[+] IOC Hunt Complete." -ForegroundColor Cyan