UAT-5616 & Chollima Campaigns: Cisco SD-WAN Zero-Days & npm Supply Chain Attacks — Detection Engineering Briefing

---
title: Potential Cisco SD-WAN Webshell Activity
id: 5b1c3f8e-7a6d-4b9e-8c1d-2f3e4a5b6c7d
description: Detects file creation or process execution patterns associated with XenShell and Godzilla webshells on Cisco infrastructure or Linux endpoints.
author: Security Arsenal Research
date: 2026/05/17
references:
  - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
  - attack.persistence
  - attack.webshell
logsource:
  product: linux
  service: auditd
detection:
  selection:
    exe|endswith:
      - '/java'
      - '/tomcat'
    cmdline|contains:
      - 'XenShell'
      - 'Godzilla'
      - 'Behinder'
  condition: selection
falsepositives:
  - Legitimate administrative tools
level: high

---
title: Npm Supply Chain Initial Access via Node.js
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects Node.js spawning PowerShell or cmd.exe, a behavior consistent with the BeaverTail loader used in the OtterCookie campaign.
author: Security Arsenal Research
date: 2026/05/17
references:
  - https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm
tags:
  - attack.initial_access
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\node.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'npm'
      - 'node'
  condition: selection
falsepositives:
  - Legitimate developer build scripts
level: medium

---
title: Outbound Connection to Known C2 Infrastructure
id: f9e8d7c6-b5a4-3210-fedc-ba9876543210
description: Detects network connections to the IP address identified in OTX Pulse related to UAT-5616 activity.
author: Security Arsenal Research
date: 2026/05/17
tags:
  - attack.command_and_control
  - c2.traffic_connection
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp|contains:
      - '176.65.139.31'
  condition: selection
falsepositives:
  - Unknown
level: critical

// Hunt for connections to the malicious C2 IP
DeviceNetworkEvents
| where RemoteIP == "176.65.139.31"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, Protocol

// Hunt for the specific file hash associated with XenShell/Godzilla
DeviceFileEvents
| where SHA256 == "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName

// Hunt for Node.js spawning PowerShell (OtterCookie/BeaverTail)
DeviceProcessEvents
| where InitiatingProcessFileName == "node.exe"
| where FileName in~ ("powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine

<#
.SYNOPSIS
    IOC Hunt Script for UAT-5616 and Chollima Campaigns
.DESCRIPTION
    Scans the filesystem for the specific XenShell/Godzilla SHA256 hash and checks for suspicious npm processes.
#>

$TargetHash = "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"
$Drives = @("C:\", "D:\")

Write-Host "[*] Initiating Hunt for Malicious Hash..." -ForegroundColor Cyan

foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        Write-Host "[*] Scanning $Drive..." -ForegroundColor Gray
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { -not $_.PSIsContainer } | 
        ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($FileHash -eq $TargetHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Checking for Suspicious Node.js Activity..." -ForegroundColor Cyan
$NodeProcesses = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "node.exe" }

foreach ($Process in $NodeProcesses) {
    $Children = Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq $Process.ProcessId }
    if ($Children) {
        foreach ($Child in $Children) {
            if ($Child.Name -in @("powershell.exe", "cmd.exe")) {
                Write-Host "[!] Suspicious Child Process: Node.js spawning $($Child.Name) (PID: $($Child.ProcessId))" -ForegroundColor Yellow
                Write-Host "    Command: $($Child.CommandLine)" -ForegroundColor Gray
            }
        }
    }
}
Write-Host "[*] Hunt Complete." -ForegroundColor Green