SynkLoader, BRIDGEHEAD & N4D Mesh: Cross-Platform Credential Theft Wave — OTX Pulse Analysis & Enterprise Detection Pack

---
title: SynkLoader MSI Staging via Teams Phishing — PowerShell Cleaner Lure
id: 8f3a1c2e-7b4d-4e1a-9c5f-2a6b8d0e1f34
status: experimental
description: Detects MSI execution followed by suspicious PowerShell child processes consistent with SynkLoader fake PowerShell-cleaner installs delivered via Microsoft Teams helpdesk phishing.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/
logsource:
    category: process_creation
    product: windows
detection:
    selection_msi:
        ParentImage|endswith:
            - '\Teams.exe'
            - '\ms-teams.exe'
            - '\explorer.exe'
        Image|endswith: '\msiexec.exe'
    selection_ps:
        ParentImage|endswith: '\msiexec.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'clean'
            - 'bypass'
            - '-enc'
            - 'hidden'
            - 'IEX'
    condition: selection_msi or selection_ps
falsepositives:
    - Legitimate IT software deployment via MSI
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1204
    - attack.t1059.001
---
title: Build-Time Malware Execution — npm Install Script / Cargo build.rs Staging
id: 4d7e9a1b-2c5f-4a8e-b3d6-9f0c1e2a5b78
status: experimental
description: Detects package managers (npm/node, cargo/rustc) spawning shell or download processes, consistent with BRIDGEHEAD npm typosquat install scripts and proc-macro1 build.rs build-time execution.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer
    - https://socket.dev/blog/popular-rust-crates-compromised
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.exe'
            - '\cargo.exe'
            - '\rustc.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\curl.exe'
            - '\certutil.exe'
            - '\wsl.exe'
            - '\rundll32.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts invoking tooling
level: high
tags:
    - attack.t1195.002
    - attack.t1059
    - attack.execution
---
title: N4D / NadMesh Botnet C2 and Credential Harvest Infrastructure
id: 1b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects network connections to known N4D Mesh Controller / NadMesh C2 and staging infrastructure, including cdnorigin.net, 209.99.186.235, and direct-IP HTTPS staging on port 9089.
author: Security Arsenal Threat Intel
date: 2026/08/22
references:
    - https://securitylabs.datadoghq.com/articles/n4d-mesh-controller-go-titan-new-infrastructure-hunting/
    - https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname:
            - 'cdnorigin.net'
            - 'tripinupdate.net'
            - 'rootfarmapp.net'
            - 'neversoftmain.net'
            - 'dondermicapp.net'
    selection_ip:
        DestinationIp:
            - '209.99.186.235'
            - '23.254.165.112'
    condition: 1 of selection_*
falsepositives:
    - Unlikely; these are dedicated malicious infrastructure
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1056

// Security Arsenal — Hunt: SynkLoader / BRIDGEHEAD / N4D-NadMesh credential theft wave
// Scope: process + network telemetry across workstations, dev machines, CI runners, and Linux AI infra
let c2_domains = dynamic(["cdnorigin.net","tripinupdate.net","rootfarmapp.net","neversoftmain.net","dondermicapp.net"]);
let c2_ips = dynamic(["209.99.186.235","23.254.165.112"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl in~ (c2_domains) or RemoteIP in (c2_ips)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let BuildExec = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("node.exe","npm.exe","cargo.exe","rustc.exe","wsl.exe","msiexec.exe")
| where FileName in~ ("powershell.exe","cmd.exe","curl.exe","certutil.exe","rundll32.exe","bash.exe","sh")
   or ProcessCommandLine has_any ("9089","rust-crate_0","go-titan","build.rs")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessParentFileName;
let CredAccess = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("Login Data","Cookies","wallet","\\.ollama","kubeconfig","credentials","sekrets")
   or FolderPath has_any ("\\.kube","\\.aws","\\.config\\gcloud")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath;
union NetHits, BuildExec, CredAccess
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt — SynkLoader / N4D-NadMesh / Supply Chain Stealers
# Run elevated on endpoints, dev workstations, and CI runners. Outputs to C:\Hunts\
$OutDir = "C:\Hunts\OTX-2026-08-22"; New-Item -ItemType Directory -Force -Path $OutDir | Out-Null

$BadDomains = @("cdnorigin.net","tripinupdate.net","rootfarmapp.net","neversoftmain.net","dondermicapp.net")
$BadIPs     = @("209.99.186.235","23.254.165.112")
$BadHashes  = @("0428fbdefa8dda10ce8fc12b1b516641e83cd5088388168e3f1a0be1432b4077",
                "151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11",
                "6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d",
                "52c11f246309cce5556a00408bafb9868622114903dbd8128dc4ce3eca2df27a",
                "6888d4c54ef2b5bf23889f9637c2efe77e1d2af4724d315b73d646cf5547dc73",
                "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482")

Write-Host "[1/6] DNS cache check for C2 domains..."
Get-DnsClientCache | Where-Object { $n=$_.Name; $BadDomains | Where-Object { $n -like "*$_*" } } |
  Export-Csv "$OutDir\dns_hits.csv" -NoTypeInformation

Write-Host "[2/6] Active/historical TCP connections to C2 IPs..."
Get-NetTCPConnection | Where-Object { $BadIPs -contains $_.RemoteAddress } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess |
  Export-Csv "$OutDir\net_hits.csv" -NoTypeInformation

Write-Host "[3/6] Hash sweep of common staging paths (Temp, Downloads, ProgramData, npm/cargo caches)..."
$Paths = @("$env:TEMP","$env:USERPROFILE\Downloads","C:\ProgramData",
           "$env:USERPROFILE\AppData\Local\npm-cache","$env:USERPROFILE\.cargo\registry")
foreach ($p in $Paths) { if (Test-Path $p) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($BadHashes -contains $h) { "HIT: $($_.FullName) [$h]" | Out-File "$OutDir\hash_hits.txt" -Append }
  } } }

Write-Host "[4/6] Scheduled tasks & Run-key persistence referencing suspicious binaries..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|node|msiexec|wsl' -and
  $_.Actions.Arguments -match 'clean|9089|rust-crate|titan' } |
  Export-Csv "$OutDir\task_hits.csv" -NoTypeInformation
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
                 "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
  Out-File "$OutDir\runkeys.txt"

Write-Host "[5/6] Typosquat package check in local node_modules / cargo registry..."
$Suspicious = @("proc-macro1","proc-macro-en","chalk-","axioss","lodashs","commander-")
foreach ($p in $Paths) { if (Test-Path $p) {
  Get-ChildItem $p -Recurse -Directory -ErrorAction SilentlyContinue |
    Where-Object { $n=$_.Name; $Suspicious | Where-Object { $n -like "$_*" } } |
    Select-Object -ExpandProperty FullName | Out-File "$OutDir\package_hits.txt" -Append } }

Write-Host "[6/6] AI-infra credential exposure check (Ollama/ComfyUI/kubeconfig)..."
@("$env:USERPROFILE\.kube\config","$env:USERPROFILE\.ollama","$env:USERPROFILE\.aws\credentials") |
  ForEach-Object { if (Test-Path $_) { "EXPOSED: $_" | Out-File "$OutDir\cred_exposure.txt" -Append } }

Write-Host "Hunt complete. Review artifacts in $OutDir"