title: Potential Infostealer.Speagle C2 Communication via Cobra DocGuard
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects network traffic to known Infostealer.Speagle C2 infrastructure associated with the Cobra DocGuard supply chain attack.
status: experimental
author: Security Arsenal
date: 2026/04/19
references:
    - https://otx.alienvault.com/
tags:
    - attack.command_and_control
    - attack.exfiltration
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|startswith:
            - '222.222.254.'
            - '60.30.147.'
        DestinationPort:
            - 8090
            - 8091
    condition: selection
falsepositives:
    - Legitimate use of Cobra DocGuard (verify destination ownership)
level: high
---
title: Fake VPN Domain Detection - NWHStealer Campaign
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6e
description: Detects DNS requests or network connections to domains associated with NWHStealer distribution campaigns.
status: experimental
author: Security Arsenal
date: 2026/04/19
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.social_engineering
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'get-proton-vpn.com'
            - 'vpn-proton-setup.com'
            - 'newworld-helloworld.icu'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: macOS notnullOSX Stealer C2 Activity
id: 9b8c7d6e-5f4a-3b2c-1d0e-9f8a7b6c5d4e
description: Detects outbound connections to known notnullOSX stealer C2 domains targeting high-value crypto wallets.
status: experimental
author: Security Arsenal
date: 2026/04/19
references:
    - https://otx.alienvault.com/
tags:
    - attack.command_and_control
    - attack.credential_access
logsource:
    category: network_connection
    product: macos
detection:
    selection:
        DestinationHostname|contains:
            - 'coockie.pro'
    condition: selection
falsepositives:
    - Unknown
level: high


kql
// Hunt for network connections to known IOCs from the pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "get-proton-vpn.com", 
    "vpn-proton-setup.com", 
    "newworld-helloworld.icu", 
    "coockie.pro",
    "huggingface"
)
or RemoteIP in (
    "83.217.209.88", 
    "222.222.254.165", 
    "60.30.147.18", 
    "111.90.145.139", 
    "185.225.17.176", 
    "38.147.173.172"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IOCType = iff(RemoteIP in ("83.217.209.88", "222.222.254.165", "60.30.147.18"), "C2_IP", "Malicious_Domain")


bash
#!/bin/bash
# IOC Hunt Script for Linux/macOS environments
# Checks for active connections to known malicious IPs

MALICIOUS_IPS=(
    "83.217.209.88"
    "222.222.254.165"
    "60.30.147.18"
    "185.225.17.176"
)

echo "Checking active network connections for known IOCs..."

for ip in "${MALICIOUS_IPS[@]}"; do
    # Using ss (modern replacement for netstat)
    connections=$(ss -tuln | grep "$ip")
    if [ -n "$connections" ]; then
        echo "[ALERT] Found active connection to malicious IP: $ip"
        echo "$connections"
    fi
done

echo "Checking hosts file for suspicious domains..."
if grep -q -E "coockie\.pro|get-proton-vpn\.com" /etc/hosts; then
    echo "[ALERT] Suspicious domain found in /etc/hosts"
    grep -E "coockie\.pro|get-proton-vpn\.com" /etc/hosts
fi


# Response Priorities

*   **Immediate**:
    *   Block all listed domains and IP addresses at the perimeter firewall and proxy.
    *   Scan endpoints for the file hashes provided (e.g., NWHStealer SHA256, Speagle hashes).
    *   Identify systems running "Cobra DocGuard" and isolate for forensic analysis.
*   **24 Hours**:
    *   Force password resets for users who may have interacted with fake VPN sites or gaming mods.
    *   Investigate macOS devices with high-value crypto wallets for signs of notnullOSX (Check `coockie.pro` connections).
    *   Patch FortiOS devices against CVE-2024-37085 and CVE-2025-32463 immediately.
*   **1 Week**:
    *   Review software supply chain security; verify integrity of development environments using marimo/HuggingFace.
    *   Implement stricter code signing policies for macOS (Block unsigned DMGs).
    *   Conduct a review of external-facing assets for exposure to the listed FortiOS CVEs.