Supply Chain & Blockchain C2: Shai-Hulud, SmartLoader, and EtherRAT Campaigns — OTX Analysis

title: Potential Shai-Hulud NPM Supply Chain Compromise
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects execution patterns associated with the malicious keyv/cacheable npm packages involving Bun runtime and suspicious domains.
author: Security Arsenal
date: 2026/08/05
references:
    - https://otx.alienvault.com/pulse/6123456789
tags:
    - attack.supply_chain
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\npm.exe'
    selection_child:
        Image|endswith:
            - '\bun.exe'
            - '\node.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'npm-cache.com'
            - 'pypi-get.com'
            - 'js-mirror.com'
            - 'preinstall'
    condition: selection_parent and selection_child or selection_cmdline
falsepositives:
    - Legitimate npm package installations by developers
level: critical

---

title: The Gentlemen EtherRAT C2 Traffic Detection
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects network connections to known EtherRAT C2 infrastructure and domains associated with The Gentlemen group.
author: Security Arsenal
date: 2026/08/05
references:
    - https://otx.alienvault.com/pulse/6123456790
tags:
    - attack.command_and_control
    - attack.c2
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '193.233.202.17'
            - '185.45.193.151'
            - '38.110.228.43'
            - '77.110.122.137'
            - '77.110.126.46'
            - '77.110.122.58'
    selection_domain:
        DestinationHostname:
            - 'resumeacceptable.com'
            - 'publisherresolution.com'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

---

title: Credential Dumping via Mimikatz (Gentlemen Affiliate)
id: 3d4e5f6a-7b8c-9d0e-1f2a-3b4c5d6e7f8a
description: Detects potential LSASS memory access indicative of credential dumping often used by EtherRAT operators.
author: Security Arsenal
date: 2026/08/05
tags:
    - attack.credential_access
    - attack.t1003.001
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x143a'
            - '0x1410'
    condition: selection
falsepositives:
    - Legitimate antivirus scanning
    - System backup processes
level: high


kql
// Hunt for Shai-Hulud NPM C2 Domains and EtherRAT Infrastructure
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl has_any ("npm-cache.com", "pypi-get.com", "js-mirror.com", "resumeacceptable.com", "publisherresolution.com") 
   or RemoteIP in ("193.233.202.17", "185.45.193.151", "38.110.228.43", "77.110.122.137", "77.110.126.46", "77.110.122.58", "83.97.20.150", "94.156.154.48")
| summarize count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by count_ desc


powershell
# IOC Hunt Script: Check for malicious NPM package artifacts and SmartLoader files

Write-Host "Starting IOC Hunt for Shai-Hulud and SmartLoader..." -ForegroundColor Cyan

# 1. Check for malicious domains in hosts file or DNS cache (Indicative of blocking failures or resolution)
$maliciousDomains = @("npm-cache.com", "pypi-get.com", "js-mirror.com", "reviewassignment.in")
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Select-String -Path $hostsPath -Pattern ($maliciousDomains -join '|') -SimpleMatch) {
    Write-Host "[ALERT] Malicious domain found in hosts file!" -ForegroundColor Red
}

# 2. Scan for specific file hashes (MD5 samples from Pulse 1 & 3)
$targetHashes = @(
    "673570abcb54b368b9521bdff8f331d4",
    "6f2e3a9ec6914209bf85be0677aadf9e",
    "82e81158366a953c33d0720dfe34b95b",
    "ab5cdef0cde09c4bb0cab33ab0d2f92e",
    "0aadd62b535e683a5a2fe31fde546d07",
    "0d03faf1764297c908158da77c8ffcae"
)

Write-Host "Scanning drive C: for known malicious file hashes..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0 } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($targetHashes -contains $hash) {
            Write-Host "[DETECTED] Malicious file found: $($_.FullName)" -ForegroundColor Red
        }
    }

# 3. Check for suspicious Bun runtime execution paths from NPM cache
$npmCache = "$env:APPDATA\npm-cache"
if (Test-Path $npmCache) {
    Write-Host "Checking NPM Cache for suspicious Bun runtime payloads..." -ForegroundColor Yellow
    Get-ChildItem -Path $npmCache -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Name -like "*bun*" } | 
        ForEach-Object {
            Write-Host "[SUSPICIOUS] Bun runtime found in npm cache: $($_.FullName)" -ForegroundColor Orange
        }
}

Write-Host "Hunt Complete." -ForegroundColor Green