Vidar, SilabRAT & Needle C2: Multi-Vector Credential Theft Campaigns Targeting Devs and End Users

title: Potential Vidar Stealer PowerShell Execution
description: Detects PowerShell commands often used in Vidar distribution campaigns via social media tutorials, such as downloading payloads from suspicious TLDs like .run or .site.
references:
  - https://otx.alienvault.com/pulse/6666b96a774f67622155207a
author: Security Arsenal
date: 2026/06/13
modified: 2026/06/13
tags:
  - attack.execution
  - attack.t1059.001
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'IEX'
  selection_tlds:
    CommandLine|contains:
      - '.run'
      - '.site'
      - '.xyz'
  condition: selection and selection_tlds
falsepositives:
  - Legitimate system administration scripts
level: high
---
title: SilabRAT Browser Profile Cloning Activity
description: Detects suspicious processes copying browser profile data (User Data or profile folders) which is indicative of SilabRAT or other infostealers performing session hijacking.
references:
  - https://otx.alienvault.com/pulse/66683c91774f676221552338
author: Security Arsenal
date: 2026/06/13
tags:
  - attack.collection
  - attack.t1005
status: experimental
logsource:
  product: windows
  category: file_access
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data'
      - '\AppData\Local\Mozilla\Firefox\Profiles'
      - '\AppData\Roaming\Opera Software\Opera Stable'
  filter_legit:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\opera.exe'
  condition: selection and not filter_legit
falsepositives:
  - Backup software
  - Browser migration tools
level: high
---
title: Malicious PyPI Package Import Execution
description: Detects the import of known malicious Python package names associated with the Hades, Mini Shai-Hulud, and Miasma campaigns targeting bioinformatics developers.
references:
  - https://otx.alienvault.com/pulse/6667219d774f676221552119
author: Security Arsenal
date: 2026/06/13
tags:
  - attack.initial_access
  - attack.t1195.002
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/python'
    CommandLine|contains:
      - 'import minishaihulud'
      - 'import miasma'
      - 'import hadesbio'
  condition: selection
falsepositives:
  - Legitimate development testing (unlikely unless intentionally using malicious names)
level: critical

// Hunt for suspicious PowerShell download activity referencing Vidar IOCs
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Invoke-WebRequest", "DownloadString", "IEX", "msget.run", "d4ug.site")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend IoCMatch = "PowerShell Suspicious Download"

// Hunt for network connections to SilabRAT C2 IP
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
| extend IoCMatch = "SilabRAT C2 Connection"

# IOC Hunt for Vidar and SilabRAT Artifacts
# Requires Admin Privileges

Write-Host "[+] Hunting for Vidar/SilabRAT artifacts..." -ForegroundColor Cyan

# Check Hosts File for Malicious Domains
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$MaliciousDomains = @("brokeapt.com", "msget.run", "d4ug.site", "rongtv.xyz", "ssffaa19.xyz")

if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($domain in $MaliciousDomains) {
        if ($HostsContent -match $domain) {
            Write-Host "[!] ALERT: Malicious domain found in hosts file: $domain" -ForegroundColor Red
        }
    }
}

# Check for Suspicious Scheduled Tasks (Common Loader Persistence)
$SuspiciousPatterns = @("HijackLoader", "Vidar", "SilabRAT", "Update-*")
Get-ScheduledTask | Where-Object { 
    $_.TaskName -match "Update" -or 
    $_.Actions.Execute -match "powershell" -and 
    $_.Actions.Arguments -match "http"
} | ForEach-Object {
    Write-Host "[!] Suspicious Scheduled Task found: $($_.TaskName)" -ForegroundColor Yellow
    Write-Host "    Action: $($_.Actions.Execute) $($_.Actions.Arguments)" -ForegroundColor Gray
}

# Check Active Connections for SilabRAT IP
netstat -ano | Select-String "91.199.163.124" | ForEach-Object {
    Write-Host "[!] ALERT: Active connection to SilabRAT C2 detected!" -ForegroundColor Red
    Write-Host "    $_" -ForegroundColor Gray
}

Write-Host "[+] Hunt complete."