UAT-8616 & FAMOUS CHOLLIMA: Critical Cisco SD-WAN Exploitation & NPM Supply Chain Attack

title: Potential UAT-8616 Webshell Activity
id: 12345678-aaaa-bbbb-cccc-123456789012
description: Detects process execution patterns associated with UAT-8616 webshells including XenShell, Godzilla, and Behinder on SD-WAN infrastructure.
author: Security Arsenal
date: 2026/05/15
status: experimental
references:
    - https://otx.alienvault.com/pulse/660000000000
tags:
    - attack.persistence
    - attack.web_shell
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\powershell.exe'
            - '\\cmd.exe'
            - '\\w3wp.exe'
        CommandLine|contains:
            - 'Godzilla'
            - 'Behinder'
            - 'XenShell'
            - 'Sliver'
    condition: selection
falsepositives:
    - Administrative scripts containing these keywords (rare)
level: high

---
title: XMRig Cryptominer Execution Post-Exploitation
id: 87654321-aaaa-bbbb-cccc-123456789012
description: Detects the execution of XMRig, often dropped by UAT-8616 following the exploitation of Cisco SD-WAN vulnerabilities.
author: Security Arsenal
date: 2026/05/15
status: experimental
references:
    - https://otx.alienvault.com/pulse/660000000000
tags:
    - attack.resource_hijacking
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: 'xmrig'
    condition: selection
falsepositives:
    - Authorized mining operations (should be blocked on enterprise servers)
level: critical


kql
// Hunt for network connections to known UAT-8616 infrastructure and file hash presence
// Source: AlienVault OTX Pulse Analysis
DeviceNetworkEvents
| where RemoteIP == "176.65.139.31"
| project Timestamp, DeviceName, InitiatingProcessAccount, RemoteIP, RemotePort, ActionType
| union (
    DeviceProcessEvents
    | where SHA256 == "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"
    | project Timestamp, DeviceName, FileName, SHA256, AccountName, ProcessCommandLine
)


powershell
# IOC Hunt Script for UAT-8616 Malware Artifacts
# Checks for the presence of specific file hashes and suspicious process activity
$TargetHash = "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"
$Drives = @("C:\", "D:\", "E:\")

Write-Host "[*] Scanning for UAT-8616 Indicators of Compromise..."

# Check for specific file hash
foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        Write-Host "[*] Scanning $Drive for matching hash..."
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($Hash -eq $TargetHash) {
                    Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                }
            } catch {
                # Ignore access errors
            }
        }
    }
}

# Check for active XMRig processes (associated with UAT-8616 monetization)
$Processes = Get-Process -ErrorAction SilentlyContinue | Where-Object {$_.ProcessName -like "*xmrig*"}
if ($Processes) {
    Write-Host "[!] SUSPICIOUS CRYPTO MINING PROCESS DETECTED:" -ForegroundColor Yellow
    $Processes | Format-Table Id, ProcessName, Path
} else {
    Write-Host "[+] No XMRig processes found."
}


**Response Priorities:**

*   **Immediate:**
    *   Block all network traffic to/from `176.65.139.31` at the firewall and proxy level.
    *   Prioritize patching for **CVE-2026-20182**, **CVE-2026-20133**, and **CVE-2026-20131** on Cisco infrastructure.
    *   Scan all endpoints for the file hash `d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa` and terminate any instances of `xmrig.exe` on non-authorized systems.
*   **24 Hours:**
    *   If OtterCookie infection is suspected (via npm packages), rotate all credentials for developers and build systems.
    *   Audit npm and `package-lock.` files for references to the "Koalemos", "BeaverTail", or "OtterCookie" packages.
*   **1 Week:**
    *   Implement strict segmentation for SD-WAN management interfaces to prevent direct internet exposure.
    *   Review and harden software supply chain security (SBOM enforcement, private npm registries).
    *   Conduct a threat hunt for webshells (Godzilla, Behinder) on internal web servers.