TraderTraitor FLATROOF/ROOFDECK Toolkit + RMM Phishing Wave: OTX Pulse Analysis — Enterprise Detection Pack

---
title: TraderTraitor Trojanized Developer Tool C2 - Fake HashiCorp Infrastructure
id: 7f3a2b1e-9c4d-4e5a-b8f1-2d6c9a0e4b21
status: experimental
description: Detects DNS resolution or network connection to TraderTraitor (DPRK) C2 infrastructure impersonating HashiCorp/Terraform registry services, associated with FLATROOF/ROOFDECK macOS trojan campaign targeting Binance.
author: Security Arsenal Threat Intel
references:
    - https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit
date: 2026/11/07
logsource:
    category: dns
product: windows
service: dns-client
detection:
    selection_domain:
        QueryName|contains:
            - 'hashicorp-aws.com'
            - 'hashicorp-terraform.io'
            - 'arusupport-region1-webhook.online'
            - 'delay.servehttp.com'
            - 'technicais.sytes.net'
    condition: selection_domain
falsepositives:
    - Legitimate HashiCorp traffic uses hashicorp.com / terraform.io — the hyphenated variants are attacker infrastructure
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1036
---
title: Unauthorized RMM Tool Execution - ScreenConnect FleetDeck SimpleHelp UltraViewer
id: 2b8c4d6f-1a3e-4f5b-9c2d-7e0a3b5d8f42
status: experimental
description: Detects execution or installation of RMM tools (ScreenConnect, FleetDeck, SimpleHelp, UltraViewer, N-able, Datto) frequently abused by Scattered Spider phishing campaigns and Hotejka Help TDS tech support scams.
author: Security Arsenal Threat Intel
date: 2026/11/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - '\ScreenConnect'
            - '\FleetDeck'
            - '\SimpleHelp'
            - '\UltraViewer'
            - '\N-able'
            - '\Ncentral'
            - '\DattoRMM'
    selection_cmdline:
        CommandLine|contains:
            - 'screenconnect'
            - 'fleetdeck'
            - 'simple-help'
            - 'ultraviewer_setup'
    filter_known_admin_paths:
        Image|startswith:
            - 'C:\Program Files\ScreenConnect Client (approved-org-guid)'
    condition: (selection_img or selection_cmdline) and not filter_known_admin_paths
falsepositives:
    - Approved RMM deployments — tune filter to your organization's authorized RMM agent paths
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.t1105
---
title: Suspicious Developer Tool Spawning Shell - Fake Job Interview Trojan Pattern
id: 4d9e1a7c-6b2f-4d8e-a1c3-5f7b9d2e6a48
status: experimental
description: Detects developer/build tools (terraform, git, node, python) spawning shells or script interpreters — consistent with TraderTraitor trojanized Terraform delivering GetShell and ReverseShell implants via fake job interview lures.
author: Security Arsenal Threat Intel
date: 2026/11/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\terraform.exe'
            - '\git.exe'
            - '\node.exe'
            - '\python.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Build pipelines and CI/CD runners — scope exclusions to known automation accounts/hosts
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204.002

// Hunt: TraderTraitor C2 + RMM phishing + Hotejka TDS indicator sweep (30 days)
let C2Domains = dynamic(["hashicorp-aws.com", "registry.hashicorp-aws.com", "registry.hashicorp-terraform.io", "diagnose.hashicorp-terraform.io", "arusupport-region1-webhook.online", "delay.servehttp.com", "technicais.sytes.net"]);
let PhishTDS = dynamic(["alertxen.store", "bigsundoc.online", "ddncsoso.com", "roi777.com", "roi-traffic.icu", "hotejka.ink", "hotejka.com", "lib1.biz", "fosetya.shop", "goalods.lol", "hotcname.help"]);
let RMMTools = dynamic(["ScreenConnect", "FleetDeck", "SimpleHelp", "UltraViewer", "n-able", "DattoRMM"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (C2Domains) or RemoteUrl has_any (PhishTDS)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemotePort, ActionType
| extend HitType = "Network IOC";
let ProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has_any (RMMTools) or ProcessCommandLine has_any (RMMTools)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HitType = "RMM Execution";
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 == "3c254614de8c1a2f213c526b0e5072d43ffeb7cc340d9a4a6ebaa16592b3bbe0"
   or MD5 in ("1017a75cf19be75f6ba21148a9b646d1","1562d523c2ebdc19c0ff8f3ea5f3763b","594a652263e5e4eb96b5164d337bc1ca","5a49d0b22ced22f9cf8b2015a327f163","5ac7526b582d9cf4f7854c52ee75f359")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5
| extend HitType = "File Hash";
union NetworkHits, ProcessHits, HashHits
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse Hunt: TraderTraitor / RMM Abuse / Help TDS
# Run elevated on endpoints; outputs findings to console + CSV
$findings = @()

# 1. Check DNS cache for TraderTraitor C2 and phishing/TDS domains
$iocDomains = @("hashicorp-aws.com","hashicorp-terraform.io","arusupport-region1-webhook.online",
    "delay.servehttp.com","technicais.sytes.net","alertxen.store","bigsundoc.online",
    "ddncsoso.com","hotejka.ink","hotejka.com","roi777.com","roi-traffic.icu",
    "lib1.biz","fosetya.shop","goalods.lol","hotcname.help")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $iocDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $findings += [pscustomobject]@{Type="DNS-IOC"; Indicator=$d; Detail="Resolved on this host"; Severity="CRITICAL"} }
}

# 2. Hunt for unauthorized RMM installations (services, processes, install dirs)
$rmmNames = @("ScreenConnect","FleetDeck","SimpleHelp","UltraViewer","N-able","DattoRMM","Ncentral")
foreach ($r in $rmmNames) {
    $svc = Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -like "*$r*" -or $_.DisplayName -like "*$r*" }
    if ($svc) { $findings += [pscustomobject]@{Type="RMM-Service"; Indicator=$r; Detail=($svc.Name + " [" + $svc.Status + "]"); Severity="HIGH"} }
    $proc = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -like "*$r*" }
    if ($proc) { $findings += [pscustomobject]@{Type="RMM-Process"; Indicator=$r; Detail=($proc.Id -join ","); Severity="HIGH"} }
}

# 3. Suspicious scheduled tasks / persistence referencing developer tools or RMM
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "terraform|UltraViewer|ScreenConnect|SimpleHelp|FleetDeck|powershell.*-enc" }
foreach ($t in $tasks) {
    $findings += [pscustomobject]@{Type="Persistence-Task"; Indicator=$t.TaskName; Detail=$t.Actions.Execute; Severity="HIGH"}
}

# 4. Run-key persistence referencing RMM or trojanized tooling
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object {
        $_.Value -match "terraform|UltraViewer|ScreenConnect|SimpleHelp|FleetDeck|servehttp|sytes.net" } |
        ForEach-Object { $findings += [pscustomobject]@{Type="Persistence-RunKey"; Indicator=$_.Name; Detail=$_.Value; Severity="HIGH"} }
}

# 5. Active connections to dynamic-DNS C2 patterns
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)" }
foreach ($c in $conns) {
    try {
        $rdns = ([System.Net.Dns]::GetHostEntry($c.RemoteAddress)).HostName
        if ($rdns -match "servehttp\.com|sytes\.net|webhook\.online") {
            $findings += [pscustomobject]@{Type="LiveC2-Connection"; Indicator=$rdns; Detail="PID $($c.OwningProcess) -> $($c.RemoteAddress):$($c.RemotePort)"; Severity="CRITICAL"}
        }
    } catch {}
}

if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings — escalate CRITICAL items to IR immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No OTX pulse indicators detected on this host." -ForegroundColor Green
}