Storm-3075 AI Phishing, SilabRAT MaaS, and 4BID ProxyShell Campaigns: OTX Pulse Analysis

---
title: Potential ProxyShell Exploitation via Exchange Backend
description: Detects suspicious serialization patterns and backend URLs associated with ProxyShell exploitation leading to webshell deployment.
references:
    - https://www.microsoft.com/security/blog
author: Security Arsenal
date: 2026/06/12
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2021.34473
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains:
            - '/api/rest/'
            - '/mapi/nspi/'
            - '/Xaml/xaml.ashx'
        cs-method: 'POST'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: Suspicious Process Injection via Hijack Loader Patterns
description: Detects potential execution of Hijack Loader or similar shellcode loaders associated with Vidar and SilabRAT.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/06/12
tags:
    - attack.defense_evasion
    - attack.t1055
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    selection_cli:
        CommandLine|contains:
            - 'javascript:'
            - 'DllRegisterServer'
            - '.dat,'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration
level: medium
---
title: Credential Stealer File Creation Patterns
description: Detects creation of files often dropped by Vidar or Lumma stealers in temp directories.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/06/12
tags:
    - attack.collection
    - attack.t1005
logsource:
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '\Temp\'
            - '\AppData\Local\Temp\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
    filter_legit:
        Image:
            - 'C:\Windows\System32\*'
            - 'C:\Program Files\*'
    condition: selection and not filter_legit
falsepositives:
    - Software installers
level: medium


kql
// Hunt for network connections to known IOCs from Pulse Data
let IOCs = dynamic(["91.199.163.124", "185.221.153.121", "45.112.194.82", "138.226.236.52", "brokeapt.com", "rongtv.xyz"]);
DeviceNetworkEvents
| where RemoteIP in (IOCs) or RemoteUrl has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

// Hunt for process executions matching file hashes
let Hashes = pack_array("0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531", "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b");
DeviceProcessEvents
| where SHA256 in (Hashes) or MD5 in (pack_array("008cd423ca45134d3343f66cced1d104"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, MD5
| order by Timestamp desc


powershell
# IOC Hunt Script for Storm-3075 and SilabRAT Activity
# Checks for specific file hashes and suspicious network connections

$TargetHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
)

$SuspiciousIPs = @(
    "91.199.163.124",
    "185.221.153.121",
    "45.112.194.82"
)

Write-Host "[+] Scanning for Malicious File Hashes..." -ForegroundColor Cyan

# Scan common download and temp directories
$PathsToScan = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for Active Network Connections to Suspicious IPs..." -ForegroundColor Cyan

$Connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { 
    $SuspiciousIPs -contains $_.RemoteAddress 
}

if ($Connections) {
    foreach ($Conn in $Connections) {
        $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] SUSPICIOUS CONNECTION: RemoteIP=$($Conn.RemoteAddress), Port=$($Conn.RemotePort), Process=$($Process.ProcessName) (PID=$($Conn.OwningProcess))" -ForegroundColor Red
    }
} else {
    Write-Host "[-] No suspicious connections found." -ForegroundColor Green
}