Vidar v1.5, Gremlin & Void Dokkaebi: Cross-Platform Credential Harvesting & Supply Chain Threats — OTX Pulse Analysis

title: Potential Vidar Stealer Go Binary Execution
id: 4f8e2b1a-9c3d-4f5e-8b1a-2c3d4e5f6a7b
description: Detects execution of Go binaries exhibiting behavior consistent with Vidar v1.5, including network connections to non-standard ports or Telegram/Steam infrastructure.
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6648d1a0b1e1b10f2c3e4f5b
tags:
    - attack.credential_access
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_go:
        Image|endswith:
            - '.exe'
        Company|contains:
            - 'Not Signed' # Generic check, refine via Go compiler signatures if available
    selection_network:
        NetworkEvent|contains:
            - '149.154.167.99' # Known Telegram IP used in pulse
            - 'steamcommunity.com'
            - 't.me'
    condition: selection_go and selection_network
falsepositives:
    - Legitimate Go applications communicating with Telegram APIs
level: high
---
title: VS Code Task Execution - Potential Void Dokkaebi Supply Chain
id: 5a9f3c2b-1d4e-5f6a-9b0c-1d2e3f4a5b6c
description: Detects suspicious process execution patterns indicative of VS Code tasks being used as an initial access vector (Fake Job Interview lure).
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6648d1a0b1e1b10f2c3e4f5b
tags:
    - attack.initial_access
    - attack.supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Code.exe'
            - '\code.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cli:
        CommandLine|contains:
            - 'clone'
            - 'npm install'
            - 'nuget'
            - 'dotnet restore'
    condition: selection_parent and selection_child and selection_cli
falsepositives:
    - Legitimate developer builds
level: high
---
title: macOS ClickFix AppleScript Network Activity
id: 6b0a4d3c-2e5f-6a7b-0c1d-2e3f4a5b6c7d
description: Detects macOS osascript processes initiating network connections to suspicious domains associated with the ClickFix campaign.
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6648d1a0b1e1b10f2c3e4f5b
tags:
    - attack.execution
    - attack.credential_access
logsource:
    category: network_connection
    product: macos
detection:
    selection_process:
        Image|endswith:
            - '/osascript'
            - '/Terminal'
    selection_domain:
        DestinationHostname|contains:
            - 'bull-run.fun'
            - 'spot-wave.fun'
    condition: selection_process and selection_domain
falsepositives:
    - Low
level: critical

// Hunt for Vidar and Gremlin C2 traffic and ClickFix domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("bull-run.fun", "spot-wave.fun", "steamcommunity.com") 
   or RemoteIP in ("149.154.167.99", "135.181.237.59", "176.65.139.31")
| extend Info = pack("InitiatingProcessAccount", InitiatingProcessAccount, "InitiatingProcessFileName", InitiatingProcessFileName)
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, RemotePort, Info
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt script for Vidar, Gremlin, and ClickFix IOCs provided in OTX Pulse.
.DESCRIPTION
    Checks running processes against known hashes and network connections to malicious IPs.
#>

$MaliciousHashes = @(
    "702ef1b4007f07887e9faaee0667b50b", # Vidar MD5
    "87332fcdf79e1c0bfb7713e9a52c0313",
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5", # Gremlin SHA256
    "e12285f507c847b986233991b86b22e3"  # ClickFix MD5
)

$MaliciousIPs = @(
    "149.154.167.99",
    "135.181.237.59",
    "176.65.139.31"
)

Write-Host "[+] Checking for malicious file hashes in running processes..." -ForegroundColor Cyan
Get-Process | ForEach-Object {
    $process = $_
    try {
        $path = $process.Path
        if ($path -and (Test-Path $path)) {
            $hash = (Get-FileHash -Path $path -Algorithm MD5).Hash.ToLower()
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS PROCESS DETECTED: $($process.ProcessName) (PID: $($process.Id)) - Path: $path" -ForegroundColor Red
            }
        }
    } catch {}
}

Write-Host "[+] Checking for active network connections to malicious C2 IPs..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $connections) {
    $remoteIP = (Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $ipString = $conn.RemoteAddress.ToString()
    if ($MaliciousIPs -contains $ipString) {
        Write-Host "[!] SUSPICIOUS CONNECTION: Process $remoteIP connected to $ipString on port $($conn.RemotePort)" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green