TraderTraitor Terraform Supply-Chain Campaign, Blockchain-C2 Hotel Intrusion Wave & Flax Typhoon Disruption: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Trojanized Terraform Provider Loader Execution (TraderTraitor / FLATROOF / ROOFDECK)
id: 7f3a2c1e-9b4d-4e6a-a2f1-tt2026a001
status: experimental
description: Detects Bash loader execution chains spawned from Terraform provider processes or downloads from HashiCorp lookalike infrastructure, consistent with TraderTraitor trojanized provider tradecraft.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
references:
  - https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver
logsource:
  category: process_creation
  product: linux
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/terraform'
      - '/terraform-provider'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/osascript'
  selection_network_ref:
    CommandLine|contains:
      - 'hashicorp-terraform.io'
      - 'delay.servehttp.com'
      - 'arusupport-region1-webhook.online'
  condition: (selection_parent and selection_child) or selection_network_ref
falsepositives:
  - Legitimate Terraform provider plugins invoking helper binaries (rare; providers are Go binaries and do not normally spawn shells)
level: high
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.004
---
title: Blockchain API Query for C2 Resolution (EtherRAT / TONResolver)
id: 7f3a2c1e-9b4d-4e6a-a2f1-bc2026a002
status: experimental
description: Detects non-browser processes making HTTPS connections to public blockchain API endpoints used by EtherRAT and TONResolver to resolve C2 infrastructure from on-chain data.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
references:
  - https://cofense.com/blog/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.etherscan.io'
      - 'api.toncenter.com'
      - 'tonapi.io'
      - 'api.bscscan.com'
      - 'polygonscan.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  filter_wallets:
    Image|contains:
      - '\MetaMask\'
      - '\Ledger\'
      - '\Trezor\'
  condition: selection_dest and not 1 of filter_*
falsepositives:
  - Crypto portfolio tracker desktop applications
  - Internal Web3 development tooling (scope by OU/user group for hospitality environments)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
---
title: Malicious LNK Execution via Guest-Complaint Phishing (Hospitality Campaign)
id: 7f3a2c1e-9b4d-4e6a-a2f1-lnk2026a003
status: experimental
description: Detects LNK shortcut files spawning script interpreters or LOLBins, matching the fake guest-complaint phishing chain delivering EtherRAT, TONResolver, PureRAT, and NetSupport Manager RAT.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
  selection_cmd:
    CommandLine|contains:
      - '.lnk'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_cmd and selection_child
falsepositives:
  - Administrative shortcut automation; baseline and whitelist known admin LNK paths
level: medium
tags:
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1218

// Blockchain-C2 & TraderTraitor infrastructure hunt — Microsoft Sentinel
// Covers: blockchain API C2 resolution, HashiCorp typosquat contact, hotel-campaign domains, Cloudflare Tunnel abuse
let BlockchainAPIs = dynamic(["api.etherscan.io","api.toncenter.com","tonapi.io","api.bscscan.com","polygonscan.com","api.trongrid.io"]);
let PulseIOCs = dynamic(["hashicorp-terraform.io","diagnose.hashicorp-terraform.io","delay.servehttp.com","arusupport-region1-webhook.online","gateway001kir.com","sslgateway001.com","waygatterol002.com","zloapobikahy23.bond","perrine90-deltajohnsons.com","kadmecnp-643laolmd.com","lermontov-656idlop.com","98aicai.com","youtubecard.com","c0cc.cc","98aicode.com"]);
let BrowserProc = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","iexplore.exe"]);
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (PulseIOCs)
       or (RemoteUrl has_any (BlockchainAPIs) and not(InitiatingProcessFileName has_any (BrowserProc)))
       or (RemoteUrl has "trycloudflare.com" and not(InitiatingProcessFileName has_any (BrowserProc)))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType, HuntType="NetworkIOC";
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any (PulseIOCs)
       or (InitiatingProcessFileName =~ "explorer.exe" and ProcessCommandLine has ".lnk" and FileName in~ ("powershell.exe","wscript.exe","mshta.exe","rundll32.exe"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, HuntType="ProcessBehavior";
union NetHits, ProcHits
| sort by TimeGenerated desc

# Security Arsenal — OTX Pulse IOC Hunt (2026-10-09)
# Targets: TraderTraitor FLATROOF/ROOFDECK artifacts, EtherRAT/TONResolver/PureRAT/NetSupport persistence, Flax Typhoon relay signs
# Run elevated on endpoints; export results for central collection.

$Report = [System.Collections.Generic.List[object]]::new()

# --- 1. File hash sweep (FLATROOF / ROOFDECK samples) ---
$HashIOCs = @(
  "188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666",
  "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97",
  "9d78ece09457907b730d139e4e0c64dd",
  "8473f85bda00dfa3ecd2385dd38f69600d1d64a6"
)
$SearchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","$env:USERPROFILE\.terraform.d","C:\ProgramData")
foreach ($p in $SearchPaths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      try {
        $h = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop
        $hm = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($HashIOCs -contains $h.Hash.ToLower() -or $HashIOCs -contains $hm.ToLower()) {
          $Report.Add([pscustomobject]@{Type="HashMatch"; Path=$_.FullName; SHA256=$h.Hash})
        }
      } catch {}
    }
  }
}

# --- 2. DNS cache check for pulse domains ---
$DomainIOCs = "hashicorp-terraform.io|delay.servehttp.com|arusupport-region1-webhook.online|gateway001kir.com|sslgateway001.com|waygatterol002.com|zloapobikahy23.bond|perrine90-deltajohnsons.com|trycloudflare.com|kadmecnp-643laolmd.com|lermontov-656idlop.com|98aicai.com|youtubecard.com|c0cc.cc|98aicode.com"
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match $DomainIOCs } | ForEach-Object {
  $Report.Add([pscustomobject]@{Type="DNSCacheHit"; Path=$_.Entry; SHA256=""})
}

# --- 3. Persistence: Run keys, scheduled tasks referencing script interpreters or blockchain API hosts ---
$RunKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($k in $RunKeys) {
  if (Test-Path $k) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match "powershell|wscript|mshta|rundll32|\.lnk|etherscan|toncenter|tonapi" } | ForEach-Object {
      $Report.Add([pscustomobject]@{Type="RunKey"; Path="$k\$($_.Name)"; SHA256=$_.Value})
    }
  }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { ($_.Actions.Execute -match "powershell|wscript|mshta") -or ($_.Actions.Arguments -match "etherscan|toncenter|tonapi|cloudflare") } | ForEach-Object {
  $Report.Add([pscustomobject]@{Type="ScheduledTask"; Path=$_.TaskName; SHA256=($_.Actions.Execute + " " + $_.Actions.Arguments)})
}

# --- 4. Live network connections to pulse infrastructure / blockchain APIs from odd processes ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  try {
    $resolved = [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName
    if ($resolved -match $DomainIOCs -or $resolved -match "etherscan|toncenter|tonapi") {
      $Report.Add([pscustomobject]@{Type="NetConnection"; Path="$($proc.ProcessName) ($($proc.Id)) -> $($_.RemoteAddress):$($_.RemotePort) [$resolved]"; SHA256=""})
    }
  } catch {}
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\otx_pulse_hunt_20261009.csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($Report.Count) findings exported to $env:TEMP\otx_pulse_hunt_20261009.csv"