UAT-8616 & Chollima APTs: Cisco SD-WAN Exploits & NPM Supply Chain Attacks — OTX Pulse Analysis

title: Potential UAT-8616 Webshell Activity via Cisco SD-WAN
description: Detects potential webshell activity associated with XenShell or Godzilla following exploitation of Cisco SD-WAN vulnerabilities.
status: experimental
date: 2026/05/18
author: Security Arsenal
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: web
detection:
    selection_uri:
        Uri|contains:
            - '/api/v1/monitor'
            - '/component'
    selection_keywords:
        cs-method: POST
    selection_headers:
        cs-user-agent|contains:
            - 'godzilla'
            - 'behinder'
            - 'xenshell'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative access to Cisco SD-WAN Manager
level: critical
---
title: Malicious NPM Package Execution - BeaverTail/OtterCookie
description: Detects execution of potentially malicious npm packages associated with the Contagious Interview campaign (BeaverTail/OtterCookie).
status: experimental
date: 2026/05/18
author: Security Arsenal
references:
    - https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm
tags:
    - attack.initial_access
    - attack.t1195.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\
ode.exe'
        - Image|endswith: '\
pm.cmd'
    selection_cli:
        CommandLine|contains:
            - 'beavertail'
            - 'ottercookie'
            - 'koalemos'
            - 'invisibleferret'
    condition: all of selection_*
falsepositives:
    - Legitimate developers installing packages with similar names (unlikely)
level: high
---
title: Suspicious Process Execution - Interlock Ransomware Loader
description: Detects execution of PlasmaLoader or GhostKnife binaries associated with Interlock Ransomware Group.
status: experimental
date: 2026/05/18
author: Security Arsenal
references:
    - https://www.recordedfuture.com/blog/march-2026-cve-landscape
tags:
    - attack.execution
    - attack.t1059\logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\plasmaloader.exe'
            - '\\ghostknife.exe'
            - '\\ghostsaber.exe'
    condition: selection
falsepositives:
    - Rare, these names are specific to the threat actor
level: critical


kql// Hunt for C2 communication related to UAT-8616 IP and known ports
DeviceNetworkEvents
| where RemoteIP == \"176.65.139.31\"
| project Timestamp, DeviceName, InitiatingProcessAccount, InitiatingProcessCommandLine, RemoteIP, RemotePort, Protocol

// Hunt for execution of Node.js processes potentially loading malicious NPM packages
DeviceProcessEvents
| where FileName in~ (\"node.exe\", \"npm.cmd\")
| where ProcessCommandLine has_any (\"beavertail\", \"ottercookie\", \"koalemos\")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath

// Hunt for file hashes associated with UAT-8616 payloads
DeviceFileEvents
| where SHA256 == \"d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa\" or MD5 == \"d75cb9920d1d3d280518ddccfe4789d2\"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessAccountName


powershell# PowerShell IOC Hunt Script for UAT-8616 and NPM Packages
# Usage: Run as Administrator on endpoints

Write-Host \"[*] Starting Threat Hunt for UAT-8616 and Chollima Indicators...\" -ForegroundColor Cyan

# 1. Check for Specific File Hashes
$targetHashes = @(
    \"d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa\",
    \"d75cb9920d1d3d280518ddccfe4789d2\"
)

Write-Host \"[*] Scanning for known malicious file hashes...\" -ForegroundColor Yellow
Get-ChildItem -Path C:\\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object { 
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($targetHashes -contains $hash) {
            Write-Host \"[!] MALICIOUS FILE FOUND: $($_.FullName)\" -ForegroundColor Red
        }
    }

# 2. Check for Suspicious NPM Modules
Write-Host \"[*] Checking for malicious npm packages (beavertail, ottercookie)...\" -ForegroundColor Yellow
$npmPaths = @(\"$env:\\APPDATA\
pm\", \"$env:\\ProgramFiles\
odejs\
ode_modules\")

foreach ($path in $npmPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Directory -Recurse -ErrorAction SilentlyContinue | 
            Where-Object { $_.Name -match \"beavertail|ottercookie|koalemos|invisibleferret\" } | 
            ForEach-Object { 
                Write-Host \"[!] SUSPICIOUS NPM MODULE FOUND: $($_.FullName)\" -ForegroundColor Red 
            }
    }
}

# 3. Check for Suspicious Scheduled Tasks (Persistence)
Write-Host \"[*] Checking for suspicious scheduled tasks...\" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -match \"powershell|cmd|wscript\" -and 
    $_.TaskName -notmatch \"Microsoft|Windows\" -and 
    $_.TaskName -match \"update|service|daemon\" 
} | Select-Object TaskName, Actions, Author | Format-Table -AutoSize

Write-Host \"[*] Hunt Complete.\" -ForegroundColor Green