TwizAdmin MaaS & Lazarus Mach-O Man: OTX Pulse Analysis — Credential Theft & Supply Chain Attacks

---
title: Potential Laravel Helpers.php Backdoor Creation
id: 9d8f7a6b-c5d4-4e3f-8a2b-1c9d0e8f7a6b
description: Detects the creation or modification of helpers.php in web directories, a pattern associated with the Laravel Lang compromise.
status: experimental
date: 2026/05/26
author: Security Arsenal
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\vendor\\laravel-lang\\'
      - '\\lang\\'
    TargetFilename|endswith:
      - '\\helpers.php'
  condition: selection
falsepositives:
  - Legitimate developer updates to language files
level: high
---
title: Suspicious PowerShell Command Line Encoded
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects encoded PowerShell command lines often used by Cloud Atlas and TwizAdmin for initial payload execution.
status: experimental
date: 2026/05/26
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
      - 'FromBase64String'
  condition: selection
falsepositives:
  - System administration scripts
level: medium
---
title: TwizAdmin or Mach-O Man C2 Domain Connection
id: 7f8e9d0c-1b2a-3c4d-5e6f-7a8b9c0d1e2f
description: Detects network connections to known C2 domains associated with TwizAdmin and Lazarus Mach-O Man campaigns.
status: experimental
date: 2026/05/26
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'fanonlyatn.xyz'
      - 'livemicrosft.com'
      - 'flipboxstudio.info'
      - 'allgoodsdirect.com.au'
      - 'istochnik.org'
  condition: selection
falsepositives:
  - Rare, unlikely legitimate traffic
tags:
  - c2
  - infostealer
level: critical


**KQL (Microsoft Sentinel)**
kql
// Hunt for File Hash IOCs across DeviceFileEvents
let MalwareHashes = dynamic(["06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4", "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90", "d47de3772f2d61a043e7047431ef4cf4"]);
DeviceFileEvents
| where SHA256 in (MalwareHashes) or MD5 in (MalwareHashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| extend Alert = "Malware File Hash Detected"
;
// Hunt for Network IOCs
let C2Domains = dynamic(["fanonlyatn.xyz", "livemicrosft.com", "flipboxstudio.info", "istochnik.org"]);
DeviceNetworkEvents
| where RemoteUrl in (C2Domains)
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| extend Alert = "C2 Communication Detected"


**PowerShell Hunt Script**
powershell
# IOC Hunter for TwizAdmin, Mach-O Man, and KICS Artifacts
# Requires Administrator privileges for full file system access

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "d47de3772f2d61a043e7047431ef4cf4",
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b"
)

$ScanPaths = @("C:\Users\", "C:\ProgramData\", "C:\\inetpub\\wwwroot")

Write-Host "[!] Starting IOC Scan for Dark Web Credential Theft Malware..." -ForegroundColor Cyan

foreach ($Path in $ScanPaths) {
    if (Test-Path $Path) {
        Write-Host "[*] Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $File = $_
            if ($File.Length -gt 0) {
                try {
                    $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                    if ($TargetHashes -contains $Hash) {
                        Write-Host "[!] MALICIOUS FILE FOUND: $($File.FullName)" -ForegroundColor Red
                        Write-Host "    Hash: $Hash" -ForegroundColor Red
                    }
                } catch {
                    # Ignore file access errors
                }
            }
        }
    }
}

# Check for Laravel Compromise Artifacts
$WebRoots = @("C:\inetpub\", "C:\xampp\", "C:\wamp64\")
Write-Host "[*] Checking for Laravel helpers.php backdoors..." -ForegroundColor Yellow
foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Get-ChildItem -Path $Root -Filter "helpers.php" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "[!] Suspicious helpers.php found: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}

Write-Host "[*] Scan Complete." -ForegroundColor Green