TroyDen, Famous Chollima & Mr_Rot13 Campaigns: GitHub/npm Supply Chain & cPanel Exploitation Detection Pack

---
title: Potential TroyDen LuaJIT Infostealer Execution
id: 5e8a9c1b-2d3f-4a5e-8b9c-1d2e3f4a5b6c
description: Detects execution of LuaJIT binaries often used by TroyDen to deliver LummaStealer or Redline, specifically from download directories or via obfuscated chains.
status: experimental
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a2f1b2c0e8e1e3b4c5d6
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\luajit.exe'
            - '\wluajit.exe'
            - '\lua51.dll'
    condition: selection
falsepositives:
    - Legitimate developer usage of LuaJIT
level: high
---
title: Suspicious NPM Child Process - OtterCookie/Famous Chollima
id: 6f9b0d2c-3e4g-5h6i-0j1k-2l3m4n5o6p7q
description: Detects npm or node.exe spawning a shell (cmd or powershell), a common behavior in malicious npm packages like OtterCookie to execute post-install scripts.
status: experimental
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a2f1b2c0e8e1e3b4c5d7
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts
level: medium
---
title: Linux SSH Authorized Keys Modification - Mr_Rot13 Persistence
id: 7g0c1e3d-4f5h-6i7j-8k9l-0m1n2o3p4q5r
description: Detects modification of authorized_keys files on Linux, indicative of SSH backdoor persistence used by Mr_Rot13 following cPanel exploitation.
status: experimental
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a2f1b2c0e8e1e3b4c5d8
tags:
    - attack.persistence
    - attack.t1098.004
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        name: '/home/*/.ssh/authorized_keys'
    selection_perm:
        type: 'SYSCALL'
        syscall: 'openat'
        exit: '-EACCES'
    condition: selection
falsepositives:
    - Legitimate user key management
level: high


kql
// Hunt for TroyDen C2 IPs and Mr_Rot13 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP has_any ("89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121", "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118") 
   or RemoteUrl has_any ("wrned.com", "wpsock.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc


powershell
# Mr_Rot13 Payload Hunt Script
# Checks for specific MD5 hashes associated with the Go-based installer

$targetHashes = @( 
    "02a5990b11293236e01f174f5999df20",
    "22613c952459e65ce09fb6b5c1c03d47",
    "2286f126ab4740ccf2595ad1fa0c615c",
    "29222f5e73dd10088fcf1204aa21f87f",
    "2de27ca8d97124adaf604b18161a441e"
)

Write-Host "Scanning for Mr_Rot13 Payload Hashes..." -ForegroundColor Yellow

$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($drive in $drives) {
    Write-Host "Scanning $drive..." -ForegroundColor Cyan
    Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue -File | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10MB } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($targetHashes -contains $hash) {
            Write-Host "[!] MALWARE DETECTED: $($_.FullName)" -ForegroundColor Red
        }
    }
}
Write-Host "Scan Complete." -ForegroundColor Green