UNC6993 LLMJacking & SnakeKeylogger Quotation Phishing: OTX Pulse Analysis — Cloud Credential Theft Detection Pack

---
title: SnakeKeylogger Phishing Execution Chain - JS Dropper to PowerShell
id: 7f3a1c2e-9b4d-4e5a-8c1f-2d6e9a0b3f51
status: experimental
description: Detects the SnakeKeylogger quotation-phishing chain where wscript/cscript executes JavaScript from extracted archives spawning obfuscated PowerShell downloaders/decryptors.
author: Security Arsenal Threat Intel
references:
  - https://asec.ahnlab.com/ko/96494/
date: 2026/11/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_child:
    Image|endswith: '\powershell.exe'
  selection_obfuscation:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'downloadstring'
      - 'AesCryptoServiceProvider'
      - '-bxor'
  condition: selection_parent and selection_child and 1 of selection_obfuscation
falsepositives:
  - Rare legitimate software installers using JS bootstrapper scripts
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1059.001
  - attack.deobfuscate_decode
  - attack.t1027
---
title: SnakeKeylogger Process Hollowing - Suspicious Child of Legitimate System Process
id: 2a8d4f1b-6c3e-4a7d-9f2b-1e5c8d0a4b62
status: experimental
description: Detects process hollowing behavior consistent with SnakeKeylogger payload injection, where hollowed processes show anomalous network or spawning behavior.
author: Security Arsenal Threat Intel
references:
  - https://asec.ahnlab.com/ko/96494/
date: 2026/11/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_unsigned_path:
    Image|endswith:
      - '\svchost.exe'
      - '\RegAsm.exe'
      - '\MSBuild.exe'
      - '\notepad.exe'
      - '\dllhost.exe'
  filter_legit_svchost:
    Image|startswith: 'C:\\Windows\\System32\\'
    CommandLine|contains: ' -k '
  condition: selection_unsigned_path and not filter_legit_svchost
falsepositives:
  - Developer build tooling (RegAsm/MSBuild legitimate usage)
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.012
---
title: LLMJacking - Outbound Connection to UNC6993 Proxy Infrastructure
id: 9c1e5b3d-4f7a-4b8c-a2d6-3e9f1b5c7d83
status: experimental
description: Detects network connections to UNC6993 LLMJacking proxy/reseller domains associated with stolen LLM API access monetization.
author: Security Arsenal Threat Intel
references:
  - https://cloud.google.com/blog/ko/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models
date: 2026/11/12
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'jet-night.com'
      - 'newapi.pro'
      - 'hostsailor.com'
  condition: selection
falsepositives:
  - Threat research activity
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041

// Hunt: SnakeKeylogger execution chain + UNC6993 LLMJacking infrastructure
// Microsoft Sentinel / Defender XDR — 30-day retrohunt
let BadDomains = dynamic(["jet-night.com", "newapi.pro", "hosting2.ro.hostsailor.com"]);
let BadHashes = dynamic(["e89c8668c8b5041768a59c1532edf2ad", "2c03ae90ed7f33a8599d22efb8811a9f0f0d535a64cbc34360e83be852845d68"]);
union isfuzzy=true
    // Network hits against campaign infrastructure
    (DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl has_any (BadDomains)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType),
    // JS -> PowerShell phishing execution chain
    (DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
    | where FileName =~ "powershell.exe"
    | where ProcessCommandLine has_any ("-enc", "FromBase64String", "IEX", "downloadstring", "AesCryptoServiceProvider", "-bxor")
    | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine),
    // File hash hits
    (DeviceFileEvents
    | where Timestamp > ago(30d)
    | where MD5 in (BadHashes) or SHA256 in (BadHashes)
    | project Timestamp, DeviceName, FileName, FolderPath, MD5, SHA256),
    // Abnormal LLM API egress (LLMJacking billing anomaly precursor)
    (DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl has_any ("api.openai.com", "generativelanguage.googleapis.com", "api.anthropic.com")
    | summarize Connections=count(), UniqueRemoteIPs=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName
    | where Connections > 500 or UniqueRemoteIPs > 20)

# Security Arsenal - SnakeKeylogger & LLMJacking IOC Hunt Script
# Run elevated on endpoints or via RMM/Intune remediation at scale
$Report = @()

# 1. Check for SnakeKeylogger persistence (Run keys commonly abused)
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match 'AppData|Temp|\.js|powershell.*-enc|wscript') {
                $Report += [PSCustomObject]@{Type="SuspiciousRunKey"; Path=$key; Name=$_.Name; Value=$val}
            }
        }
    }
}

# 2. Scheduled tasks masquerading as updaters (SnakeKeylogger persistence)
Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'update|sync|service' -and
    ($_.Actions.Execute -match 'powershell|wscript|mshta') -and
    $_.TaskPath -notmatch 'Microsoft'
} | ForEach-Object {
    $Report += [PSCustomObject]@{Type="SuspiciousTask"; Path=$_.TaskPath; Name=$_.TaskName; Value=$_.Actions.Execute}
}

# 3. Known payload hashes on disk (common drop locations)
$BadSHA256 = "2c03ae90ed7f33a8599d22efb8811a9f0f0d535a64cbc34360e83be852845d68"
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:USERPROFILE\Downloads")
foreach ($p in $SearchPaths) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -eq $BadSHA256) {
            $Report += [PSCustomObject]@{Type="HashMatch"; Path=$_.FullName; Name=$_.Name; Value="SnakeKeylogger payload"}
        }
    }
}

# 4. Active/recent connections to campaign infrastructure
$BadHosts = @("jet-night.com", "newapi.pro", "hosting2.ro.hostsailor.com")
foreach ($h in $BadHosts) {
    $resolved = Resolve-DnsName $h -ErrorAction SilentlyContinue
    if ($resolved) {
        $Report += [PSCustomObject]@{Type="DNSResolution"; Path="DNSCache/Resolver"; Name=$h; Value=($resolved.IPAddress -join ",")}
    }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $rd = try { (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost } catch { $null }
    if ($BadHosts -contains $rd) {
        $Report += [PSCustomObject]@{Type="ActiveC2Connection"; Path=$_.OwningProcess; Name=$rd; Value="$($_.RemoteAddress):$($_.RemotePort)"}
    }
}

# 5. Hunt for LLM API keys staged in environment variables or config (LLMJacking precursor)
Get-ChildItem Env: | Where-Object { $_.Name -match 'OPENAI|ANTHROPIC|AZURE_OPENAI|GEMINI|API_KEY' } | ForEach-Object {
    $Report += [PSCustomObject]@{Type="LLMKeyExposure"; Path="Environment"; Name=$_.Name; Value="Key present - verify legitimacy"}
}

if ($Report.Count -gt 0) { $Report | Format-Table -AutoSize; $Report | Export-Csv "$env:TEMP\ioc_hunt_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Output "[+] No IOCs or suspicious artifacts found on $env:COMPUTERNAME" }