The latest OTX pulse data reveals a convergence of sophisticated threats targeting government entities, critical infrastructure, and enterprise organizations. Chinese threat actor UTA0565 is actively exploiting zero-day vulnerabilities in Google Chrome (CVE-2026-85046) and Microsoft Windows (CVE-2026-87491, CVE-2026-85880) through highly targeted phishing campaigns impersonating legitimate organizations such as China Digital Times and the Center for American Progress. This campaign specifically targets Asian government entities, NGOs, and media organizations, deploying the CLEANGULP malware family for initial access and privilege escalation.
Simultaneously, a collaboration between UAC-0099 and Sandworm has been observed targeting Ukrainian agricultural and grain logistics companies with MythicRatatoskr, a previously undocumented Go-based backdoor. This malware leverages the Yggdrasil mesh network for command-and-control communications, utilizing end-to-end encrypted IPv6 traffic to evade traditional network monitoring. The attack chain begins with spearphishing emails deploying the MATCHWOK backdoor, followed by MythicRatatoskr for persistent access and SDelete for anti-forensics.
The third pulse details an INC ransomware campaign that compromised at least 175 endpoints across a single organization. The 17-day gap between initial access (early August) and ransomware deployment (late August) indicates the involvement of an Initial Access Broker (IAB) who established persistence using scheduled tasks with randomized names and lateral movement via compromised RDP credentials, before handing off access to the ransomware affiliate. The attack involved AnyDesk for remote access, Impacket for lateral movement, and BYOVD (Bring Your Own Vulnerable Driver) techniques for defense evasion.
Threat Actor / Malware Profile
UTA0565 & CLEANGULP
UTA0565 is a Chinese state-sponsored threat actor conducting cyber-espionage against government and civil society targets. The group registers typosquatted domains (e.g., chinadigitaltimes.top, americanprgoress.top) to host convincing phishing pages that deliver exploit kits. The attack chain begins with targeted phishing emails containing links to fake websites that fingerprint victims before delivering the Chrome zero-day exploit (CVE-2026-85046). Upon successful exploitation, the actor deploys CLEANGULP, a sophisticated implant that leverages Windows privilege escalation vulnerabilities (CVE-2026-87491, CVE-2026-85880) to gain SYSTEM-level access. CLEANGULP communicates with actor-controlled infrastructure using encrypted HTTP/S protocols and maintains persistence through registry run keys and scheduled tasks.
UAC-0099 / Sandworm & MythicRatatoskr
UAC-0099, operating in collaboration with Sandworm (APT44), represents a significant threat to Ukrainian critical infrastructure. Their latest tool, MythicRatatoskr, is written in Go and utilizes the Yggdrasil network—a decentralized, end-to-end encrypted IPv6 mesh network—for C2 communications. This approach renders traditional domain-based blocking ineffective, as traffic appears as legitimate Yggdrasil peer-to-peer connections. The malware is deployed following initial compromise via MATCHWOK, and utilizes MATCHBOIL for additional payload delivery. SDelete is employed to securely delete forensic artifacts and hinder incident response. Persistence is achieved through Windows services and registry modifications, with the malware masquerading as legitimate system processes.
INC Ransomware
The INC ransomware operation follows a double-extortion model, exfiltrating sensitive data before encryption. The attack chain observed involves initial access via exposed RDP or VPN credentials (likely purchased from an IAB), followed by the deployment of AnyDesk for persistent remote access. The threat actor utilizes Impacket tools for lateral movement, creating scheduled tasks with randomized names to execute payloads across the network. A BYOVD attack is employed to disable endpoint detection and response (EDR) solutions before final ransomware deployment. The 17-day dwell time suggests thorough network reconnaissance and data staging prior to encryption.
IOC Analysis
The pulses provide a mix of network and host-based indicators critical for detection:
Network Indicators: The UTA0565 campaign provides domain indicators including typosquatted domains (chinadigitaltimes.top, americanprgoress.top) and C2 infrastructure (halal-navi.net, outsourcingwise.net, halaltak.net, personclouds.com, thecovnresation.net). The MythicRatatoskr pulse includes domains (egyptanimals.com, uztickets.com, adomd.net) likely used for initial payload delivery or fallback C2. The INC pulse provides throughoutes.net, associated with ransomware infrastructure.
Host Indicators: Multiple SHA1 file hashes are provided for MythicRatatoskr, MATCHWOK, and associated tools, enabling hash-based blocking in EDR solutions.
SOC Operationalization: Security teams should immediately ingest these indicators into SIEM and EDR platforms. Domain indicators should be blocked at DNS and web proxy levels. However, note that MythicRatatoskr's use of Yggdrasil mesh networking means traditional domain blocking is insufficient—teams must monitor for Yggdrasil protocol anomalies (IPv6 UDP traffic on port 9001, known Yggdrasil peer connections). File hashes should be used for retroactive hunting across the enterprise to identify historical infections.
Detection Engineering
---
title: UTA0565 CLEANGULP C2 Communication
id: 8f4e2a1b-3c5d-4e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects network connections to known UTA0565 C2 domains associated with CLEANGULP malware and Chrome/Windows 0-day exploitation
author: Security Arsenal
references:
- https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits
date: 2026/10/24
tags:
- attack.command_and_control
- attack.t1071
- attack.t1566
logsource:
category: dns
product: windows
detection:
selection:
query|contains:
- 'halal-navi.net'
- 'outsourcingwise.net'
- 'halaltak.net'
- 'personclouds.com'
- 'americanprgoress.top'
- 'chinadigitaltimes.top'
- 'thecovnresation.net'
condition: selection
falsepositives:
- Legitimate research or threat intelligence lookups
level: high
---
title: MythicRatatoskr Yggdrasil Mesh Network Activity
id: 9a5f3b2c-4d6e-5f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects execution of Yggdrasil mesh network processes or Go-based binaries associated with MythicRatatoskr backdoor
author: Security Arsenal
references:
- https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
date: 2026/10/24
tags:
- attack.command_and_control
- attack.t1095
- attack.t1572
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\yggdrasil.exe'
- Image|endswith: '\ratatoskr.exe'
selection_cmd:
CommandLine|contains:
- 'yggdrasil'
- '-peer'
- 'ipv6'
selection_hash:
- Hashes|contains: '01855153ca7a33ad5ff36451de5612dfba0dd2ca'
- Hashes|contains: '028ca11f3f0d8396043af7bf756231fc2f50f829'
- Hashes|contains: '09c816697c0c2aff9b4ff58681558ca30d04c9cd'
- Hashes|contains: '131a371a1e4ee78ec3b2863607c99290ec3b58a6'
- Hashes|contains: '4e3e6577866e4ce2ed73ca089700ae04230e768f'
condition: 1 of selection_*
falsepositives:
- Legitimate Yggdrasil mesh network usage (rare in enterprise environments)
level: critical
---
title: INC Ransomware Scheduled Task Persistence
id: 7b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects creation of scheduled tasks with randomized names commonly used by INC ransomware affiliates for persistence and lateral movement
author: Security Arsenal
references:
- https://www.huntress.com/blog/two-inc-ransom-notes
date: 2026/10/24
tags:
- attack.persistence
- attack.t1053
- attack.t1021
logsource:
category: process_creation
product: windows
detection:
selection_schtasks:
Image|endswith: '\schtasks.exe'
CommandLine|contains:
- '/create'
- '/tn'
selection_random:
CommandLine|re: '.*\\[a-zA-Z0-9]{8,12}\.exe.*'
selection_anydesk:
CommandLine|contains:
- 'anydesk'
- 'ad_'
condition: selection_schtasks and (selection_random or selection_anydesk)
falsepositives:
- Legitimate software deployment tools
- Administrative scripts
level: high
// Hunt for UTA0565, MythicRatatoskr, and INC ransomware indicators
let Lookback = 30d;
// UTA0565 Domain Indicators
let UTA0565_Domains = dynamic(["halal-navi.net", "outsourcingwise.net", "halaltak.net", "personclouds.com", "americanprgoress.top", "chinadigitaltimes.top", "thecovnresation.net"]);
// MythicRatatoskr File Hashes
let MythicHashes = dynamic(["01855153ca7a33ad5ff36451de5612dfba0dd2ca", "028ca11f3f0d8396043af7bf756231fc2f50f829", "09c816697c0c2aff9b4ff58681558ca30d04c9cd", "131a371a1e4ee78ec3b2863607c99290ec3b58a6", "4e3e6577866e4ce2ed73ca089700ae04230e768f"]);
// MythicRatatoskr Domains
let MythicDomains = dynamic(["egyptanimals.com", "uztickets.com", "adomd.net"]);
// INC Ransomware Domain
let INCDomain = dynamic(["throughoutes.net"]);
// Network-based detection
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl in~ (UTA0565_Domains) or RemoteUrl in~ (MythicDomains) or RemoteUrl in~ (INCDomain)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, ActionType
| extend Threat = case(
RemoteUrl in~ (UTA0565_Domains), "UTA0565/CLEANGULP",
RemoteUrl in~ (MythicDomains), "MythicRatatoskr/UAC-0099",
RemoteUrl in~ (INCDomain), "INC Ransomware",
"Unknown"
)),
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where SHA1 in~ (MythicHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, ProcessCommandLine, InitiatingProcessFileName
| extend Threat = "MythicRatatoskr/MATCHWOK"
)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count() by DeviceName, Threat, RemoteUrl, FileName, SHA1
| order by LastSeen desc
# IOC Hunt Script for UTA0565, MythicRatatoskr, and INC Ransomware Artifacts
# Run with administrative privileges
Write-Host "=== Security Arsenal IOC Hunt: APT & Ransomware Artifacts ===" -ForegroundColor Cyan
Write-Host "Scanning for indicators from OTX Pulses (2026-10-24)...`n" -ForegroundColor Gray
$FoundIndicators = @()
# 1. Check for UTA0565/CLEANGULP persistence (Registry Run Keys)
Write-Host "[+] Checking Registry Run Keys for suspicious entries..." -ForegroundColor Yellow
$RunKeys = @(
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $RunKeys) {
if (Test-Path $key) {
$values = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
$suspicious = $values.PSObject.Properties | Where-Object {
$_.Name -match '^[a-zA-Z0-9]{8,12}$' -or
$_.Value -match 'halal|outsourcing|personcloud|chinadigitaltimes'
}
if ($suspicious) {
$suspicious | ForEach-Object {
$FoundIndicators += [PSCustomObject]@{
Type = "Registry Persistence"
Location = $key
Name = $_.Name
Value = $_.Value
Threat = "Potential UTA0565/CLEANGULP"
}
}
}
}
}
# 2. Check for MythicRatatoskr file hashes
Write-Host "[+] Checking for MythicRatatoskr file hashes..." -ForegroundColor Yellow
$MythicHashes = @(
"01855153ca7a33ad5ff36451de5612dfba0dd2ca",
"028ca11f3f0d8396043af7bf756231fc2f50f829",
"09c816697c0c2aff9b4ff58681558ca30d04c9cd",
"131a371a1e4ee78ec3b2863607c99290ec3b58a6",
"4e3e6577866e4ce2ed73ca089700ae04230e768f"
)
$SearchPaths = @("C:\Users", "C:\ProgramData", "C:\Windows\Temp")
foreach ($path in $SearchPaths) {
Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.Length -lt 50MB } |
ForEach-Object {
try {
$hash = Get-FileHash -Path $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue
if ($MythicHashes -contains $hash.Hash) {
$FoundIndicators += [PSCustomObject]@{
Type = "Malicious File Hash"
Location = $_.FullName
Name = $_.Name
Value = $hash.Hash
Threat = "MythicRatatoskr/MATCHWOK"
}
}
} catch {}
}
}
# 3. Check for INC Ransomware scheduled tasks
Write-Host "[+] Checking Scheduled Tasks for randomized names (INC Ransomware tactic)..." -ForegroundColor Yellow
$Tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
$_.TaskName -match '^[a-zA-Z0-9]{8,12}$' -and
$_.TaskPath -notlike "*Microsoft*"
}
foreach ($task in $Tasks) {
$FoundIndicators += [PSCustomObject]@{
Type = "Suspicious Scheduled Task"
Location = $task.TaskPath
Name = $task.TaskName
Value = ($task.Actions | Select-Object -First 1).Execute
Threat = "Potential INC Ransomware/IAB"
}
}
# 4. Check for AnyDesk installation (common INC tool)
Write-Host "[+] Checking for AnyDesk artifacts..." -ForegroundColor Yellow
$AnyDeskPaths = @(
"$env:ProgramData\AnyDesk",
"$env:APPDATA\AnyDesk",
"$env:LOCALAPPDATA\AnyDesk"
)
foreach ($path in $AnyDeskPaths) {
if (Test-Path $path) {
$FoundIndicators += [PSCustomObject]@{
Type = "Remote Access Tool"
Location = $path
Name = "AnyDesk Directory"
Value = "AnyDesk installation detected"
Threat = "INC Ransomware TTP"
}
}
}
# 5. Check network connections to known C2 domains
Write-Host "[+] Checking active network connections to IOC domains..." -ForegroundColor Yellow
$C2Domains = @(
"halal-navi.net", "outsourcingwise.net", "halaltak.net",
"personclouds.com", "chinadigitaltimes.top", "thecovnresation.net",
"egyptanimals.com", "uztickets.com", "adomd.net", "throughoutes.net"
)
$Connections = Get-NetTCPConnection -ErrorAction SilentlyContinue |
Where-Object { $_.State -eq "Established" -and $_.RemotePort -in @(80, 443, 9001, 8080) }
foreach ($conn in $Connections) {
try {
$hostname = ([System.Net.Dns]::GetHostEntry($conn.RemoteAddress)).HostName
foreach ($domain in $C2Domains) {
if ($hostname -match $domain) {
$FoundIndicators += [PSCustomObject]@{
Type = "Active C2 Connection"
Location = "Network"
Name = $hostname
Value = "$($conn.RemoteAddress):$($conn.RemotePort)"
Threat = "C2 Communication"
}
}
}
} catch {}
}
# 6. Check for Yggdrasil mesh network process
Write-Host "[+] Checking for Yggdrasil mesh network processes..." -ForegroundColor Yellow
$YggdrasilProcess = Get-Process -Name "yggdrasil*" -ErrorAction SilentlyContinue
if ($YggdrasilProcess) {
$FoundIndicators += [PSCustomObject]@{
Type = "Suspicious Process"
Location = $YggdrasilProcess.Path
Name = $YggdrasilProcess.ProcessName
Value = "Yggdrasil mesh network active"
Threat = "MythicRatatoskr C2"
}
}
# Output Results
Write-Host "`n=== SCAN RESULTS ===" -ForegroundColor Cyan
if ($FoundIndicators.Count -eq 0) {
Write-Host "No indicators found. System appears clean." -ForegroundColor Green
} else {
Write-Host "Found $($FoundIndicators.Count) potential indicator(s):`n" -ForegroundColor Red
$FoundIndicators | Format-Table -AutoSize | Out-String | Write-Host
# Export to CSV
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$exportPath = "$env:TEMP\IOC_Hunt_Results_$timestamp.csv"
$FoundIndicators | Export-Csv -Path $exportPath -NoTypeInformation
Write-Host "Results exported to: $exportPath" -ForegroundColor Yellow
}
Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan
Response Priorities
Immediate Actions (0-4 hours)
- Network Blocking: Immediately block all domains listed in the pulses (
halal-navi.net,outsourcingwise.net,chinadigitaltimes.top,egyptanimals.com,throughoutes.net, etc.) at DNS, web proxy, and firewall egress points. Note that MythicRatatoskr's Yggdrasil C2 requires IPv6 traffic monitoring and blocking of Yggdrasil peer connections. - Hash Blocking: Deploy SHA1 hash blocks for MythicRatatoskr and MATCHWOK samples to EDR platforms (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne) to prevent execution.
- Patch Verification: Verify all Chrome browsers are updated to the latest version and Windows systems have patches for CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Prioritize patching for systems used by government, NGO, and media personnel.
- Scheduled Task Audit: Execute the provided PowerShell script to hunt for suspicious scheduled tasks with randomized names (8-12 characters) created between August and October 2026.
24-Hour Actions
- Identity Verification: Force password resets for all administrative accounts and users in targeted sectors (Government, NGO, Media, Agriculture). Review authentication logs for suspicious RDP logons and VPN access, particularly from unusual geographies.
- Lateral Movement Hunt: Search for evidence of Impacket usage, wmiexec, psexec, and RDP lateral movement patterns. Review Windows Event Logs (Event IDs 4624, 4625, 4648) for credential abuse.
- BYOVD Detection: Check for the presence of vulnerable drivers commonly used in BYOVD attacks (e.g., gdrv.sys, dbutil_2_3.sys) and block their loading via Windows Defender Application Control (WDAC) or AppLocker policies.
1-Week Actions
- Architecture Hardening: Implement application whitelisting to prevent unauthorized executables (blocking unsigned Go binaries like MythicRatatoskr). Deploy network segmentation to isolate critical infrastructure (particularly agricultural and logistics systems in Ukraine-related operations).
- Email Security: Enhance email filtering to detect typosquatted domains and lookalike domains (e.g.,
americanprgoress.topvsamericanprogress.org). Implement DMARC, DKIM, and SPF enforcement. - IPv6 Monitoring: Deploy IPv6 network monitoring and anomaly detection to identify unauthorized Yggdrasil mesh network traffic. Consider disabling IPv6 on endpoints if not required for business operations.
- Backup Verification: Verify offline backup integrity and test restoration procedures to mitigate INC ransomware impact. Ensure backups are immutable and isolated from the network.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.