TwizAdmin Ransomware & Ghost Stadium Phishing: OTX Pulse Analysis — Global C2 Infrastructure Alert

---
title: TwizAdmin C2 Domain Connection
id: 8a1f2c3d-4e5f-6789-0123-456789abcdef
description: Detects network connections to the known TwizAdmin C2 domain fanonlyatn.xyz associated with DataBreachPlus operations.
status: experimental
author: Security Arsenal
date: 2026/05/28
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains: 'fanonlyatn.xyz'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071

---
title: Ghost Stadium Phishing Domain Access
id: b2c3d4e5-6f78-9012-3456-7890abcdef12
description: Detects DNS requests or HTTP connections to known GHOST STADIUM phishing domains targeting the 2026 World Cup.
status: experimental
author: Security Arsenal
date: 2026/05/28
logsource:
    category: dns
detection:
    selection:
        QueryName|endswith:
            - 'fifa.gold'
            - 'fifa.black'
            - 'fifa.tax'
            - 'fifaweb.com'
            - 'fifa.red'
            - 'fifa.fund'
            - 'fifa-com.shop'
    condition: selection
falsepositives:
    - Legitimate FIFA access (unlikely given TLDs)
level: high
tags:
    - attack.initial_access
    - attack.phishing
    - attack.t1566

---
title: Suspicious Middle East C2 Infrastructure Connection
id: c3d4e5f6-7890-1234-5678-90abcdef1234
description: Detects outbound connections to IP addresses identified as Middle Eastern C2 servers hosting APT frameworks.
status: experimental
author: Security Arsenal
date: 2026/05/28
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp|in:
            - '37.32.15.8'
            - '197.51.170.131'
            - '5.109.182.231'
            - '93.113.62.247'
            - '94.252.245.193'
            - '148.178.22.16'
    condition: selection
falsepositives:
    - Legitimate traffic to these IPs (should be investigated)
level: high
tags:
    - attack.command_and_control
    - attack.t1102

// Hunt for TwizAdmin and Ghost Stadium Network Activity
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "fanonlyatn.xyz" or 
    RemoteUrl has "fifa.gold" or 
    RemoteUrl has "fifa.black" or 
    RemoteUrl has "fifa.tax" or
    RemoteUrl has "fifaweb.com" or
    RemoteUrl has "fifa.red" or
    RemoteUrl has "fifa.fund" or
    RemoteUrl has "fifa-com.shop"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| summarize Count = count() by DeviceName, RemoteUrl
| order by Count desc

// Hunt for Malicious IP Connections (Middle East C2)
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in ("37.32.15.8", "197.51.170.131", "5.109.182.231", "93.113.62.247", "94.252.245.193", "148.178.22.16")
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

# Hunt for TwizAdmin File Artifacts and Registry Persistence
# Requires Admin privileges

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150",
    "9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec"
)

$MaliciousIPs = @(
    "37.32.15.8", "197.51.170.131", "5.109.182.231", "93.113.62.247", "94.252.245.193", "148.178.22.16"
)

Write-Host "[+] Checking for TwizAdmin File Hashes..." -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking for active network connections to C2 IPs..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -State Established | 
               Where-Object { $MaliciousIPs -contains $_.RemoteAddress }

if ($connections) {
    Write-Host "[!] Suspicious Connections Detected:" -ForegroundColor Red
    $connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
} else {
    Write-Host "[-] No active connections to known C2 IPs found." -ForegroundColor Green
}

Write-Host "[+] Checking Run Keys for suspicious persistence..." -ForegroundColor Cyan
Get-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | 
    Get-ItemProperty | 
    ForEach-Object { 
        $_.PSObject.Properties | Where-Object {$_.Name -ne "PSPath"} | Select-Object Name, Value 
    }