TwizAdmin MaaS & JINX-0164 Dev Targeting: Multi-Stage Crypto Theft & Regional C2 Surge Analysis

title: Potential TwizAdmin Java RAT C2 Activity
id: 8e4f1a20-b1e2-4c3d-9e5f-6a7b8c9d0e1f
description: Detects Java processes (TwizAdmin) establishing connections on non-standard port 1337, associated with the FastAPI C2 panel.
author: Security Arsenal
date: 2026/05/28
modified: 2026/05/28
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\java.exe'
        DestinationPort: 1337
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate Java applications running on port 1337 (rare)
level: high

---

title: Suspicious macOS Shell Script Download (JINX-0164)
id: f3b2c1d0-e9f8-4a7b-8c6d-5e4f3a2b1c0d
description: Detects curl or wget processes downloading shell scripts from suspicious paths often used in JINX-0164 initial access.
author: Security Arsenal
date: 2026/05/28
modified: 2026/05/28
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1566.001
logsource:
    category: process_creation
    product: macos
detection:
    selection_tools:
        Image|endswith:
            - '/curl'
            - '/wget'
    selection_payload:
        CommandLine|contains:
            - 'install.sh'
            - 'troubleshoot/mac'
    condition: all of selection*
falsepositives:
    - Legitimate developer tooling updates
level: medium

---

title: Typosquatting Domain Access - LinkedIn Phishing (JINX-0164)
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Identifies DNS requests or process connections to known typosquatting domains used in JINX-0164 campaigns.
author: Security Arsenal
date: 2026/05/28
modified: 2026/05/28
tags:
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: dns_query
    product: windows
detection:
    selection_domains:
        QueryName|contains:
            - 'teamicrosoft.com'
            - 'live.us.org'
            - 'driver-updater.net'
    condition: selection_domains
falsepositives:
    - None expected
level: critical


kql
// Hunt for JINX-0164 and TwizAdmin Network Indicators
// Scope: DeviceNetworkEvents, DeviceProcessEvents
let IOCs = dynamic([
    "fanonlyatn.xyz", 
    "driver-updater.net", 
    "live.ong", 
    "teamicrosoft.com",
    "login.teamicrosoft.com",
    "89.36.224.5",
    "37.32.15.8",
    "197.51.170.131"
]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (IOCs) or RemoteIP has_any (IOCs)
| extend ThreatIntel = "TwizAdmin_JINX0164"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ThreatIntel
| sort by Timestamp desc


powershell
# IOC Hunt Script for TwizAdmin / JINX-0164 Indicators
# Checks for file presence of specific hashes and registry persistence artifacts

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"
)

$SuspiciousDomains = @(
    "fanonlyatn.xyz",
    "driver-updater.net",
    "teamicrosoft.com"
)

Write-Host "[+] Hunting for TwizAdmin / JINX-0164 File Hashes..." -ForegroundColor Cyan

# Scan C:\ drive for specific hashes (Requires Get-FileHash)
$PathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
        ForEach-Object {
            try {
                $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($TargetHashes -contains $Hash) {
                    Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (Hash: $Hash)" -ForegroundColor Red
                }
            } catch {
                # Ignore access errors
            }
        }
    }
}

Write-Host "[+] Checking Hosts File for Suspicious Domains..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $SuspiciousDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $Domain" -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Checking for Suspicious Scheduled Tasks (Generic Clipper/RAT patterns)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.TaskName -match "Update" -or 
    $_.TaskName -match "Driver" -or
    $_.Actions.Execute -match "java" -or
    $_.Actions.Execute -match "powershell" -and 
    $_.Actions.Arguments -match "-enc"
} | Select-Object TaskName, State, LastRunTime | Format-Table -AutoSize