The Gentlemen RaaS & Void Dokkaebi Supply Chain: OTX Pulse Analysis — Multi-Vector Credential Theft

---
title: Potential VS Code Supply Chain Compromise - Void Dokkaebi
id: 4e8f9a2b-1c3d-4f5e-8b7a-0d9e1f2a3b4c
description: Detects the execution of suspicious VS Code tasks often used by Void Dokkaebi to execute malware via poisoned repository tasks..
status: experimental
date: 2026/04/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624b1c5f4b3e8d1b1e1e1e1/
tags:
    - attack.supply_chain
    - attack.execution
    - detection.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Code.exe'
        Image|endswith: '\cmd.exe' # or powershell.exe
        CommandLine|contains: '.vscode/tasks.'
    condition: selection
falsepositives:
    - Legitimate developer build tasks using npm scripts or similar.
level: high
---
title: macOS ClickFix AppleScript Network Connection
id: 5f9g0b3c-2d4e-5g6f-9c8b-1e0f2g3h4i5j
description: Detects the osascript utility establishing network connections, a common behavior in the ClickFix campaign to download stealers or exfiltrate data.
status: experimental
date: 2026/04/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624b1c5f4b3e8d1b1e1e1e2/
tags:
    - attack.execution
    - attack.collection
    - macos
logsource:
    category: network_connection
    product: macos
detection:
    selection:
        Image|endswith: '/usr/bin/osascript'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate automation scripts requiring network access.
level: medium
---
title: AdaptixC2 Framework Suspicious Process Patterns
id: 6a0h1c4d-3e5f-6h7i-0d9c-2f1g3h4i5j6k
description: Detects potential AdaptixC2 agent activity based on typical process execution patterns involving Go or C++ binaries with network and child process anomalies.
status: experimental
date: 2026/04/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624b1c5f4b3e8d1b1e1e1e3/
tags:
    - attack.command_and_control
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_go:
        Image|endswith: '.exe'
        Company: ''
        CommandLine|contains: '-c2' # Typical flag usage for C2 frameworks
    selection_net:
        CommandLine|contains:
            - 'https://'
            - 'dns://'
    condition: all of selection_*
falsepositives:
    - Unsigned legitimate network tools.
level: high

// Hunt for Void Dokkaebi C2 IPs and suspicious network activity
let IoC_IPs = dynamic(["166.88.4.2", "85.239.62.36", "23.27.20.143", "23.27.202.27", "23.27.120.142", "154.91.0.196", "198.105.127.210", "83.168.68.219", "172.94.9.250"]);
let IoC_Domains = dynamic(["bull-run.fun", "spot-wave.fun", "moonscan.live", "scanclaw.live"]);
DeviceNetworkEvents
| where RemoteIP in (IoC_IPs) or RemoteUrl has_any (IoC_Domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt for Void Dokkaebi artifacts and malicious VS Code tasks.
.DESCRIPTION
    Scans user directories for .vscode/tasks. files and checks for specific IOCs.
#>

# Define Void Dokkaebi IP patterns (simplified for script)
$MaliciousIPs = @("166.88.4.2","85.239.62.36","23.27.20.143")

# Check for VS Code tasks. files in user profiles
Write-Host "[+] Scanning for VS Code task configurations..."
$Users = Get-ChildItem -Path "C:\Users\" -Directory
foreach ($User in $Users) {
    $VSCodePath = Join-Path -Path $User.FullName -ChildPath ".vscode\tasks."
    if (Test-Path $VSCodePath) {
        Write-Host "[!] Found tasks. at: $VSCodePath" -ForegroundColor Yellow
        # Basic keyword check for suspicious commands (e.g., certutil, powershell encoded)
        $Content = Get-Content $VSCodePath -Raw -ErrorAction SilentlyContinue
        if ($Content -match "certutil|powershell.*-e|IEX") {
            Write-Host "[ALERT] Suspicious command pattern detected in $VSCodePath" -ForegroundColor Red
        }
    }
}

# Check active network connections for C2 IPs
Write-Host "[+] Checking active network connections..."
$ActiveConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($Conn in $ActiveConnections) {
    $RemoteIP = $Conn.RemoteAddress
    if ($MaliciousIPs -contains $RemoteIP) {
        $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[ALERT] Connection to malicious IP $RemoteIP found via process: $($Process.ProcessName) (PID: $($Process.Id))" -ForegroundColor Red
    }
}
Write-Host "[*] Hunt complete."