Storm-3075 AI Impersonation & UAT-8616 SD-WAN Exploitation: SilabRAT, Vidar, and Cisco Breaches

---
title: Potential Vidar/Lumma Stealer Execution via Hijack Loader
id: c4c3c4c4-0000-0000-0000-000000000001
description: Detects execution patterns associated with Hijack Loader dropping Vidar or Lumma stealers, characterized by suspicious PowerShell arguments and specific child processes.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1f2c00000000
tags:
    - attack.credential_access
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\\explorer.exe'
            - '\\chrome.exe'
            - '\firefox.exe'
            - '\\msedge.exe'
            - '\\cmd.exe'
    selection_loader:
        Image|endswith:
            - '\
undll32.exe'
            - '\
egsvr32.exe'
            - '\\powershell.exe'
    selection_suspicious_cli:
        CommandLine|contains:
            - '-encodedcommand'
            - '-enc'
            - 'brokeapt.com'
            - 'pan.rongtv.xyz'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Cisco SD-WAN Webshell Creation Detection
id: c4c3c4c4-0000-0000-0000-000000000002
description: Detects potential webshell file creation (Godzilla/XenShell) on systems vulnerable to Cisco SD-WAN exploits CVE-2026-20128.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1f2c00000001
tags:
    - attack.initial_access
    - attack.persistence
logsource:
    category: file_event
    product: linux
detection:
    selection_paths:
        TargetFilename|contains:
            - '/var/www/html/'
            - '/usr/local/tmp/'
            - '/opt/'
    selection_extensions:
        TargetFilename|endswith:
            - '.jsp'
            - '.php'
            - '.aspx'
    selection_keywords:
        TargetFilename|contains:
            - 'shell'
            - 'xen'
            - 'godzilla'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative uploads
level: critical
---
title: SilabRAT C2 Network Connection
id: c4c3c4c4-0000-0000-0000-000000000003
description: Detects outbound connection to known SilabRAT infrastructure IP 91.199.163.124 or non-standard ports associated with HVNC.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/618a1f2c00000002
tags:
    - attack.c2
    - attack.command_and_control
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '91.199.163.124'
    selection_port:
        DestinationPort:
            - 4444
            - 5555
            - 8080
    condition: 1 of selection_*
falsepositives:
    - Rare legitimate traffic to this IP
level: high

// Hunt for Vidar/Lumma Hashes and C2 Domains
let IOCHashes = pack_array(
  \"0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531\",
  \"25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a\",
  \"3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b\"
);
let IOCUrls = pack_array(\"brokeapt.com\", \"pan.rongtv.xyz\", \"pan.ssffaa19.xyz\");
DeviceNetworkEvents
| where RemoteUrl has_any (IOCUrls) or RemoteIP == \"91.199.163.124\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| union DeviceProcessEvents
| where SHA256 in (IOCHashes)
| project Timestamp, DeviceName, FolderPath, SHA256, AccountName

# SilabRAT and Vidar IOC Hunter
# Checks for file presence and registry persistence

$MaliciousHashes = @(
    \"0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531\",
    \"25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a\",
    \"3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b\"
)

$SuspiciousIPs = @(\"91.199.163.124\")

Write-Host \"[+] Checking for established connections to C2 IPs...\"
$netstat = netstat -ano | Select-String \"$($SuspiciousIPs -join '|')\"
if ($netstat) { $netstat }

Write-Host \"[+] Scanning common malware directories...\"
$paths = @(\"$env:TEMP\", \"$env:APPDATA\", \"$env:LOCALAPPDATA\")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -ErrorAction SilentlyContinue | Where-Object { 
        $_.Length -gt 0 -and $_.Extension -match '\\.(exe|dll|ps1)' 
    } | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $MaliciousHashes) {
            Write-Host \"[!] MALWARE DETECTED: $($_.FullName) | Hash: $hash\" -ForegroundColor Red
        }
    }
}

Write-Host \"[+] Checking for Run Keys persistence...\"
Get-Item -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -ErrorAction SilentlyContinue | 
    Get-ItemProperty | Select-Object * -ExcludeProperty PSPath,PSChildName | 
    Where-Object { $_.PSObject.Properties.Value -match \"brokeapt\" -or $_.PSObject.Properties.Value -match \"pan.rongtv\