Void Dokkaebi Supply Chain & The Gentlemen RaaS: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential Void Dokkaebi VS Code Exploitation
id: 6b7d3a1c-8f4e-4b2a-9c5d-1a2b3c4d5e6f
description: Detects suspicious processes spawned by VS Code (Code.exe) potentially indicating malicious task execution from poisoned repositories.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6b7d3a1c8f4e4b2a9c5d1a2b3c4d5e6f/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.initial_access
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Code.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
            - '\bash.exe'
            - '\node.exe'
    condition: selection
falsepositives:
    - Legitimate developer scripts execution
level: high
---
title: macOS ClickFix AppleScript Execution
id: 7c8e4b2d-9f5e-5c3b-0d6e-2b3c4d5e6f7a
description: Detects execution of osascript triggered by common browsers, consistent with ClickFix social engineering campaigns.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/7c8e4b2d9f5e5c3b0d6e2b3c4d5e6f7a/
tags:
    - attack.execution
    - attack.t1059.002
    - attack.user_execution
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|contains:
            - '/Google Chrome.app'
            - '/Firefox.app'
            - '/Safari.app'
            - '/Microsoft Edge.app'
        Image|endswith: '/osascript'
    condition: selection
falsepositives:
    - Legitimate automation extensions
level: critical
---
title: AdaptixC2 MgBot Process Injection
id: 8d9f5c3e-0g6f-6d4c-1e7f-3c4d5e6f7a8b
description: Detects potential AdaptixC2 or MgBot behavior characterized by suspicious remote thread creation often used in post-exploitation frameworks.
status: experimental
date: 2026/04/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/8d9f5c3e0g6f6d4c1e7f3c4d5e6f7a8b/
tags:
    - attack.defense_evasion
    - attack.t1055.002
    - attack.privilege_escalation
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'CreateRemoteThread'
            - 'NtCreateThreadEx'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    filter_legit:
        ParentImage|contains:
            - '\Program Files\'
            - '\System32\'
    condition: selection and not filter_legit
falsepositives:
    - Unknown
level: high

// Hunt for Void Dokkaebi and ClickFix Network Indicators
let VoidIPs = pack_array("166.88.4.2", "85.239.62.36", "23.27.20.143", "23.27.202.27", "23.27.120.142", "154.91.0.196", "198.105.127.210", "83.168.68.219", "172.94.9.250");
let MaliciousDomains = pack_array("bull-run.fun", "spot-wave.fun", "moonscan.live", "scanclaw.live", "aodefevrgdkhqltdnwgzbyjoywrlbntbhfwq.com", "aahdjjsivunugynqjvyfbhqnjekniyfboma.com");
DeviceNetworkEvents
| where RemoteIP in (VoidIPs) or RemoteUrl has_any (MaliciousDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| order by Timestamp desc

<#
    IOC Hunt Script for The Gentlemen, Void Dokkaebi, and AdaptixC2
    Checks for file presence and active network connections to known C2 infrastructure.
#>

$TargetHashes = @(
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235", # The Gentlemen
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2", # The Gentlemen
    "e12285f507c847b986233991b86b22e3", # ClickFix
    "f212fd00d9ffc0f3d868845f7f4215cb"  # AdaptixC2
)

$TargetIPs = @(
    "166.88.4.2", "85.239.62.36", "23.27.20.143", "154.91.0.196", "172.94.9.250"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Hash in $TargetHashes) {
    Write-Host "Checking for Hash: $Hash" -ForegroundColor Yellow
    foreach ($Drive in $Drives) {
        try {
            Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
            Where-Object { $_.Length -gt 0 } | 
            ForEach-Object {
                $FileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                if ($FileHash -eq $Hash) {
                    Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                }
            }
        } catch {
            # Ignore access errors
        }
    }
}

Write-Host "[+] Checking active network connections for C2 IPs..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established
foreach ($IP in $TargetIPs) {
    $Hits = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Hits) {
        Write-Host "[!] SUSPICIOUS CONNECTION FOUND to $IP" -ForegroundColor Red
        $Hits | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
    }
}
Write-Host "Scan Complete." -ForegroundColor Green


---