---
title: Potential Lazarus Mach-O Man ClickFix Activity
description: Detects suspicious terminal execution spawned by browsers on macOS, typical of ClickFix attacks used by Lazarus Group.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
tags:
    - attack.initial_access
    - attack.t1189
    - attack.execution
    - attack.t1059.004
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '/Safari'
            - '/Google Chrome'
            - '/Firefox'
        Image|endswith:
            - '/bin/bash'
            - '/bin/sh'
            - '/usr/bin/osascript'
            - '/usr/bin/curl'
        CommandLine|contains:
            - 'curl'
            - 'bash -c'
            - 'powershell' # rare on mac but possible in emu
    condition: selection
falsepositives:
    - Legitimate developer tools or user scripts
level: high
---
title: TwizAdmin C2 Infrastructure Connection
description: Detects network connections to known TwizAdmin C2 domains or specific FastAPI panel ports.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://intel.breakglass.tech/post/twizadmin-103-241-66
tags:
    - attack.command_and_control
    - attack.c2
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
    selection_port:
        DestinationPort: 1337
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical
---
title: Middle East APT C2 Traffic Detection
description: Detects outbound connections to IP addresses identified as hosting C2 infrastructure for multiple APT groups in the Middle East.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://hunt.io/blog/middle-east-malicious-infrastructure-report
tags:
    - attack.command_and_control
    - attack.g0049
    - attack.g0085
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp|in:
            - '37.32.15.8'
            - '197.51.170.131'
            - '5.109.182.231'
            - '93.113.62.247'
            - '94.252.245.193'
    condition: selection
falsepositives:
    - Legitimate traffic to the region (unlikely for these specific IPs)
level: high


kql
// Hunt for ClickFix indicators and suspicious process chains on macOS
DeviceProcessEvents
| where Timestamp > ago(1d)
| where OSPlatform == "macOS"
| where InitiatingProcessFileName in ("Safari", "Google Chrome", "firefox")
| where FileName in ("bash", "sh", "curl", "osascript")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend ClickFixRisk = iif(ProcessCommandLine contains "livemicrosft.com" or ProcessCommandLine contains "meeting" or ProcessCommandLine contains "zoom", "High", "Medium")

// Hunt for network connections to Middle East C2 Infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("37.32.15.8", "197.51.170.131", "5.109.182.231", "93.113.62.247", "94.252.245.193")
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName

// Hunt for TwizAdmin Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "fanonlyatn.xyz"
| project Timestamp, DeviceName, RemoteUrl, InitiatingProcessAccountName, InitiatingProcessFileName


powershell
# PowerShell IOC Hunt Script for TwizAdmin & ME C2 Infrastructure
# Requires Admin Privileges

Write-Host "Starting Threat Hunt for TwizAdmin and Middle East C2 IOCs..." -ForegroundColor Cyan

# 1. Check for established network connections to malicious IPs
$maliciousIPs = @(
    "37.32.15.8",
    "197.51.170.131",
    "5.109.182.231",
    "93.113.62.247",
    "94.252.245.193"
)

$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($ip in $maliciousIPs) {
    $found = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($found) {
        Write-Host "[ALERT] Active connection to C2 IP detected: $ip" -ForegroundColor Red
        Write-Host $found | Format-Table
    }
}

# 2. Check DNS Cache for TwizAdmin / Lazarus domains
$domains = @("fanonlyatn.xyz", "livemicrosft.com")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue

foreach ($domain in $domains) {
    $found = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($found) {
        Write-Host "[WARNING] DNS cache entry found for suspicious domain: $domain" -ForegroundColor Yellow
        Write-Host $found | Format-Table
    }
}

# 3. Scan specific User Downloads folders for suspicious file extensions (MacOS specific logic adapted for Win check)
# This serves as a placeholder for cross-environment awareness
Write-Host "Hunt complete. Review alerts above." -ForegroundColor Green


# Response Priorities

**Immediate (0-24h):**
*   Block all listed IP addresses and domains (`fanonlyatn.xyz`, `livemicrosft.com`) at the firewall and proxy level.
*   Initiate a hunt for file hashes associated with "Mach-O Man" and "TwizAdmin" across all endpoints.
*   Isolate any devices showing network connections to the Middle Eastern C2 IPs.

**Within 24h:**
*   Identify and reset credentials for users who may have interacted with the "ClickFix" lures or crypto-clipping malware.
*   Review browser history and session tokens for Finance/Technology team members, given the Lazarus targeting.
*   Investigate any FedEx-related phishing reports in the last 30 days.

**1 Week:**
*   Enhance email filtering to block shipping-themed lures and typo-squatted domains.
*   Conduct security awareness training specifically focusing on "ClickFix" and fake software update prompts.
*   Review egress filtering policies to limit communication to known high-risk hosting regions.