Supply Chain Swarm: Lumma, Vidar & OtterCookie Infostealers via Poisoned GitHub/NuGet Packages

title: Suspicious Package Manager Child Process Creation
id: 48a1c6d4-8b9a-4f1d-9e3a-123456789abc
description: Detects suspicious child processes spawned by NuGet, npm, or GitHub CLI, often indicating supply chain malware execution.
status: experimental
date: 2026/05/13
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\nuget.exe'
      - '\npm.cmd'
      - '\node.exe'
      - '\git.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts
level: high
---
title: Infostealer C2 Connection to Known Malicious Domains
id: 9b2e3f4a-1c5d-4e6f-9a8b-9876543210ab
description: Detects network connections to domains associated with Lumma, Vidar, and recent NuGet campaign C2 infrastructure.
status: experimental
date: 2026/05/13
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'dns-providersa2.com'
      - 'g8way.io'
      - 'trycloudflare.com'
    Initiated: 'true'
  condition: selection
falsepositives:
  - Rare (unlikely legitimate traffic)
level: critical
---
title: Trojanized MSI Installer Execution via LuaJIT
id: c3d4e5f6-7a8b-9c0d-1e2f-3a4b5c6d7e8f
description: Identifies execution of LuaJIT processes or unsigned MSI installers often used in TroyDen campaigns.
status: experimental
date: 2026/05/13
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_msi:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains: 'Temp'
    Signed: 'false'
  selection_luajit:
    Image|contains: 'luajit'
  condition: 1 of selection*
falsepositives:
  - Legitimate software installers
level: medium


kql
// Hunt for network connections to IOCs in DeviceNetworkEvents
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("dns-providersa2.com", "g8way.io", "cargomanbd.com") 
   or RemoteIP in ("89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121", "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118", "147.45.197.92", "94.228.161.88")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| top 100 by Timestamp desc


powershell
# PowerShell Hunt Script: Check for active connections to Malicious IPs
$maliciousIPs = @(
    "89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121",
    "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118",
    "147.45.197.92", "94.228.161.88"
)

Write-Host "Checking for active network connections to known C2 infrastructure..." -ForegroundColor Cyan

$connections = Get-NetTCPConnection -State Established | Where-Object { 
    $maliciousIPs -contains $_.RemoteAddress 
}

if ($connections) {
    Write-Host "[ALERT] Found active connections to malicious IPs:" -ForegroundColor Red
    foreach ($conn in $connections) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "Local: $($conn.LocalAddress):$($conn.LocalPort) -> Remote: $($conn.RemoteAddress):$($conn.RemotePort) (PID: $($conn.OwningProcess) - Process: $($process.ProcessName))"
    }
} else {
    Write-Host "No active connections to malicious IPs detected." -ForegroundColor Green
}