TwizAdmin, Mach-O Man & Void Dokkaebi: Multi-Platform MaaS & Supply Chain Threats

---
title: Potential TwizAdmin C2 Panel Connection
id: 4a8b9c1d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects outbound connections to known TwizAdmin C2 infrastructure identified in OTX pulses.
status: experimental
author: Security Arsenal
date: 2026/04/22
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationIp:
            - '31.31.198.206'
            - '103.241.66.238'
    condition: selection
falsepositives:
    - Legitimate traffic to these IPs (unlikely given their malicious nature)
level: critical
---
title: macOS ClickFix Terminal Execution via Browser
id: b1c2d3e4-f5a6-b7c8-d9e0-f1a2b3c4d5e6
description: Detects potential ClickFix activity where a browser process spawns a Terminal or Shell on macOS.
status: experimental
author: Security Arsenal
date: 2026/04/22
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
product: macos
detection:
    parent:
        Image|endswith:
            - '/Google Chrome'
            - '/Firefox'
            - '/Safari'
    child:
        Image|contains:
            - '/Terminal'
            - '/bin/bash'
            - '/bin/sh'
            - '/bin/zsh'
    condition: parent and child
falsepositives:
    - Legitimate developer workflows launching terminal from browser
level: high
---
title: VS Code Task Execution from Git Directory
id: c2d3e4f5-a6b7-c8d9-e0f1-a2b3c4d5e6f7
description: Detects execution of suspicious binaries or scripts triggered by VS Code tasks often associated with Void Dokkaebi repo poisoning.
status: experimental
author: Security Arsenal
date: 2026/04/22
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
product: windows
detection:
    selection:
        ParentImage|contains: 'Code.exe'
        CommandLine|contains:
            - 'node.exe'
            - 'python.exe'
        CurrentWorkingDirectory|contains: '.git'
    condition: selection
falsepositives:
    - Legitimate build processes using VS Code tasks
level: medium

// Hunt for network connections to Void Dokkaebi and TwizAdmin Infrastructure
DeviceNetworkEvents
| where RemoteIP in ("31.31.198.206", "166.88.4.2", "85.239.62.36", "23.27.20.143", "23.27.202.27", "154.91.0.196")
| summarize count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

// Hunt for Mach-O Man ClickFix behavior on macOS (if collecting syslog or equivalent)
DeviceProcessEvents 
| where Timestamp > ago(1d) 
| where OSType == "MacOS" 
| where InitiatingProcessFileName in~ ("Google Chrome", "firefox", "Safari") 
| where FileName in~ ("osascript", "Terminal", "bash", "sh", "zsh") 
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

// Hunt for file hash presence
DeviceFileEvents
| where SHA256 in ("06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90")
| project Timestamp, DeviceName, FolderPath, FileName, SHA256

# IOC Hunter for TwizAdmin and Void Dokkaebi C2 IPs
$MaliciousIPs = @(
    "31.31.198.206",
    "166.88.4.2",
    "85.239.62.36",
    "23.27.20.143",
    "23.27.202.27"
)

$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($IP in $MaliciousIPs) {
    $Hits = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Hits) {
        Write-Warning "[!] Suspicious connection found to $IP"
        $Hits | ForEach-Object {
            $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "PID: $($_.OwningProcess) Process: $($Process.ProcessName) LocalPort: $($_.LocalPort)"
        }
    }
}

# Scan for specific file hashes in common download directories
$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90"
)

$Paths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "C:\Temp")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Warning "[!] Malicious file found: $($_.FullName)"
            }
        }
    }
}