Vidar v1.5 Go, Gremlin Stealer & Shai-Hulud: OTX Pulse Intelligence on Multi-Vector Infostealer Campaigns

title: Potential Vidar Stealer v1.5 Go Process Activity
id: 89e83e12-6b7c-4b3e-9f1a-1c2d3e4f5a6b
description: Detects suspicious process execution patterns associated with Vidar v1.5 written in Go, including potential sandbox checks and large binary sizes.
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6283a1f8c2d0e41234567890
tags:
    - attack.credential_access
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\vidar.exe'
            - '\loader.exe'
    selection_go:
        Company|contains:
            - '' # Go binaries often have empty company fields
        OriginalFileName|contains:
            - 'go-build'
    selection_sandbox:
        CommandLine|contains:
            - 'sandbox'
            - 'vmcheck'
            - 'debugger'
    condition: 1 of selection*
falsepositives:
    - Legitimate Go applications
level: high
---
title: Malicious NPM Package Installation (Shai-Hulud)
id: 77d72e11-5a6b-3a2d-8e0a-0b1c2d3e4f5a
description: Detects the installation of known malicious NPM packages associated with the Shai-Hulud worm campaign.
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6283a1f8c2d0e41234567892
tags:
    - attack.initial_access
    - attack.software_supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\npm.cmd'
            - '\node.exe'
        CommandLine|contains:
            - 'install'
    malicious_packages:
        CommandLine|contains:
            - 'chalk-tempalte'
            - 'axios-util'
            - 'axois-utils'
            - 'color-style-utils'
    condition: selection and malicious_packages
falsepositives:
    - Legitimate developer installing similarly named packages (unlikely given typosquatting)
level: critical
---
title: Suspicious Cisco SD-WAN Vulnerability Exploitation Attempt
id: 66c61d00-4a5a-2a1c-7d09-9a0b1c2d3e4f
description: Detects potential webshell upload or exploitation activity targeting Cisco SD-WAN vulnerabilities (CVE-2026-20182).
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6283a1f8c2d0e41234567894
tags:
    - attack.initial_access
    - attack.web_shell
logsource:
    category: web
    product: apache
    service: access
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/vpn'
            - '/api'
            - '.jsp'
    selection_exploit:
        cs-uri-query|contains:
            - 'CVE-2026-20182'
            - 'teamviewersetup.exe'
            - 'godzilla'
    condition: selection_uri or selection_exploit
falsepositives:
    - Administrative management traffic
level: medium

// Hunt for Vidar/Gremlin Network Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("telegram.org", "steamcommunity.com") or RemoteIP in ("149.154.167.99", "135.181.237.59", "194.87.92.109", "80.200.28.28")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend timestamp = Timestamp

// Hunt for Shai-Hulud File Creation
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath contains "node_modules" and (FileName contains "chalk-tempalte" or FileName contains "axios-util" or FileName contains "axois-utils")
| project Timestamp, DeviceName, InitiatingProcessAccountName,FolderPath, FileName, SHA256

# IOC Hunt for Shai-Hulud NPM Packages and Suspicious Connections

Write-Host "[+] Checking for malicious NPM packages..."

$maliciousPackages = @("chalk-tempalte", "@deadcode09284814/axios-util", "axois-utils", "color-style-utils")

# Check common global npm paths
$npmPaths = @("$env:APPDATA\npm\node_modules", "$env:USERPROFILE\node_modules")

foreach ($path in $npmPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Directory | ForEach-Object {
            if ($_.Name -in $maliciousPackages) {
                Write-Host "[!] FOUND MALICIOUS PACKAGE: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check running processes for suspicious C2 connections (Vidar/Gremlin IOCs)
Write-Host "[+] Checking active network connections for known C2 IPs..."

$targetIPs = @("149.154.167.99", "135.181.237.59", "194.87.92.109", "80.200.28.28")

$activeConnections = Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

foreach ($ip in $targetIPs) {
    $matches = $activeConnections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($matches) {
        foreach ($match in $matches) {
            $process = Get-Process -Id $match.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "[!] SUSPICIOUS CONNECTION TO $ip detected by PID: $($match.OwningProcess) - Process: $($process.ProcessName)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Hunt complete."