Back to Intelligence

WindRelay NFC Fraud Combo, SloppyRAT ClickFix Chains & Head Mare TrueConf Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
September 11, 2026
10 min read

Threat Summary

Three concurrent OTX pulses paint a picture of a threat landscape that is simultaneously commoditizing fraud tooling and industrializing initial access for ransomware and espionage operations.

Pulse one documents WindRelay, a newly identified NFC relay malware family operating in combination with the SpyNote RAT and NFCGate to execute 'ghost tapping' — contactless payment fraud against banking customers in Czechia, Poland, Slovakia, and Slovenia. The attack chain is notable for its live social engineering component: fraudsters impersonate bank employees over the phone and walk victims through installing a RAT package personalized with the victim's own name, which then silently deploys the NFC relay component to intercept and re-transmit contactless payment transactions.

Pulse two covers SloppyRAT, a foothold implant identified in June 2026 and assessed as ransomware-adjacent tooling. It is delivered via multi-stage ClickFix infection chains (fake CAPTCHA / 'fix it yourself' paste-into-Run-dialog lures), stages through CastleLoader/CastleRAT infrastructure, and resolves C2 using EtherHiding — abusing the Polygon blockchain's JSON-RPC API to store and retrieve C2 configuration. It employs encrypted code blocks, junk code, indirect syscalls, and certificate pinning to frustrate analysis and interception.

Pulse three is the most severe for enterprise defenders: the Head Mare APT exploited a vulnerability chain (KLCERT-26-057, KLCERT-26-058) in unpatched TrueConf video conferencing servers, connecting to port 4307/TCP without authorization to achieve arbitrary code execution as NT AUTHORITY\SYSTEM. The group deployed the PhantomCore and PhantomGraph backdoors (alongside NightLedger, ArcBridge, and BridgeHead tooling) and — critically — replaced legitimate TrueConf client installers with trojanized versions, converting the video conferencing platform into a supply-chain distribution vector. Targeting spans manufacturing, electronics, transportation, energy, technology, and government sectors in Russia and Belarus, but the technique generalizes to any organization running exposed TrueConf infrastructure.

The collective signal: initial access is converging on trusted-channel abuse — phone calls from 'your bank,' copy-paste 'fixes,' and compromised vendor software — rather than raw exploit volume.

Threat Actor / Malware Profile

WindRelay + SpyNote + NFCGate (Android Banking Fraud)

  • Distribution: Voice-phishing (vishing) with live operator guidance; victim-installs personalized APK labeled with their own name to build trust.
  • Payload behavior: SpyNote RAT grants full device control and silently side-loads WindRelay; NFCGate-derived relay logic captures EMV/contactless card data and relays tap-to-pay transactions to attacker-controlled infrastructure ('ghost tapping').
  • C2 communication: RAT-typical persistent socket channels; relay operations coordinated in near-real-time during the fraud call.
  • Persistence: Android Accessibility Service abuse and device-admin permission grants, standard to SpyNote-class RATs.
  • Anti-analysis: Personalized per-victim builds (unique hashes per target — reflected in the 71-indicator hash-heavy pulse), name-mangled packages.

SloppyRAT (Ransomware Foothold Implant)

  • Distribution: ClickFix social engineering — victims are instructed to paste attacker-supplied PowerShell into the Run dialog or terminal, initiating a multi-stage chain via CastleLoader.
  • Payload behavior: Establishes resilient foothold for lateral movement handoff to ransomware operators.
  • C2 communication: EtherHiding — C2 addresses stored in Polygon blockchain smart-contract data, retrieved via JSON-RPC calls (e.g., to api.truesmart.org, skipraid.com infrastructure). Certificate pinning blocks TLS inspection.
  • Persistence: Staged loader artifacts; scheduled task / registry run-key establishment typical of CastleLoader chains.
  • Anti-analysis: Encrypted code blocks decrypted at runtime, junk-code padding, indirect syscalls to evade EDR userland hooks.

PhantomCore / PhantomGraph (Head Mare APT)

  • Distribution: Exploitation of TrueConf server vulnerabilities KLCERT-26-057/058 via unauthenticated access on 4307/TCP; code execution as NT AUTHORITY\SYSTEM; trojanized TrueConf client installers pushed to legitimate users (supply chain).
  • Payload behavior: Dual backdoors (PhantomCore, PhantomGraph) with auxiliary tooling (NightLedger, ArcBridge, BridgeHead) for persistence, lateral movement, and data staging.
  • C2 communication: Backdoor channels from server-side implants; client-side implants beacon from victim workstations.
  • Persistence: SYSTEM-level services and replaced installer binaries ensuring reinfection of new client deployments.
  • Anti-analysis: Legitimate-software masquerading; implants ride signed-appearing TrueConf update paths.

IOC Analysis

The indicator set across these pulses is overwhelmingly file-hash dominated (MD5 and SHA1), with a small but high-value set of network indicators:

  • File hashes (140+ total): Bulk MD5 sets for WindRelay/SpyNote APKs and PhantomCore/PhantomGraph binaries. Hash-only detection is fragile for the Android campaign (per-victim personalized builds guarantee hash churn) but viable for PhantomCore server implants where binaries are reused across victims. Operationalize via EDR blocklists and retro-hunts rather than as primary detection.
  • Domains/hostnames: skipraid.com, api.truesmart.org — SloppyRAT C2 and blockchain-RPC staging. These warrant immediate DNS sinkholing and egress proxy blocking. Also alert on any corporate endpoint making JSON-RPC calls to public Polygon nodes — legitimate enterprise use of blockchain RPC from workstations is near-zero.
  • Network behavior (no IOC required): Unauthenticated connections to TrueConf servers on 4307/TCP from non-client subnets are a high-fidelity signal independent of hashes.

Tooling: Decode and pivot on hashes with VirusTotal Enterprise / MalwareBazaar; validate domain reputation via OTX itself, urlscan.io, and passive DNS (SecurityTrails/Validin). For the Polygon EtherHiding channel, tools like B ster's etherscan-class explorers or a direct eth_call against the contract addresses referenced in the Zscaler research will extract current C2 values. Feed all indicators into your SIEM as watchlists and into EDR as custom intelligence (e.g., Defender 'indicators' API, CrowdStrike custom IOCs).

Detection Engineering

YAML
---
title: ClickFix-Style User-Executed PowerShell Stager (SloppyRAT / CastleLoader)
id: 8f3a1c2e-9b6d-4f1a-a5e7-2c8d4b6f0a11
status: experimental
description: Detects PowerShell launched from Explorer or the Run dialog with download-and-execute patterns consistent with ClickFix social engineering chains delivering SloppyRAT via CastleLoader.
references:
  - https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\svchost.exe' # Run dialog spawns via svchost in some chains
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  selection_cli:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'IEX'
      - 'DownloadString'
      - 'Start-BitsTransfer'
      - 'msgraph'
      - 'polygon'
  condition: selection_parent and selection_img and selection_cli
falsepositives:
  - Admin automation run interactively via Run dialog
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
---
title: EtherHiding C2 Resolution via Polygon JSON-RPC (SloppyRAT)
id: 4d7b2e91-6c3f-48a2-b9d1-5e0f7a3c8d22
status: experimental
description: Detects outbound JSON-RPC calls to Polygon blockchain endpoints from non-browser processes, consistent with EtherHiding C2 resolution used by SloppyRAT.
references:
  - https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\svchost.exe'
  selection_net:
    DestinationHost|contains:
      - 'polygon-rpc.com'
      - 'rpc-mainnet.matic'
      - 'matic-mainnet'
      - 'truesmart.org'
      - 'skipraid.com'
  condition: selection_proc and selection_net
falsepositives:
  - Rare; enterprise workstations have virtually no legitimate Polygon RPC use
level: critical
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
---
title: Unauthenticated Access to TrueConf Server Port 4307 (Head Mare / PhantomCore)
id: 1a9c4e77-2d5b-4f8c-93e6-7b0d2f5a9c33
status: experimental
description: Detects inbound network connections to TrueConf video conferencing server management port 4307/TCP from sources outside expected client ranges, associated with Head Mare exploitation of KLCERT-26-057/058 leading to PhantomCore/PhantomGraph deployment.
references:
  - https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 4307
    Image|endswith:
      - '\TrueConfServer.exe'
      - '\tcs_server.exe'
  filter_localhost:
    SourceIp|startswith:
      - '127.'
      - '10.10.5.' # adjust: expected TrueConf admin/client subnet
  condition: selection and not filter_localhost
falsepositives:
  - Legitimate TrueConf clients from unlisted subnets; tune filter to your topology
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1071
KQL — Microsoft Sentinel / Defender
// Sentinel hunt: SloppyRAT EtherHiding C2 + TrueConf 4307 exposure + ClickFix process chains
let Lookback = 7d;
let SloppyIOC = dynamic(["skipraid.com","api.truesmart.org","truesmart.org"]);
let PolygonRPC = dynamic(["polygon-rpc.com","rpc-mainnet.matic.network","matic-mainnet.chainstacklabs.com"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (SloppyIOC) or RemoteUrl has_any (PolygonRPC)
| extend Signal = "SloppyRAT/EtherHiding DNS"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, Signal),
(DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort == 4307 or LocalPort == 4307
| extend Signal = "TrueConf 4307/TCP connection"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl = strcat(""), RemoteIP, Signal),
(DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","wscript.exe")
| where ProcessCommandLine has_any ("IEX","DownloadString","Invoke-WebRequest","Invoke-RestMethod","Start-BitsTransfer")
| extend Signal = "ClickFix-style paste-executed stager"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl = strcat(""), RemoteIP = strcat(""), Signal)
| sort by TimeGenerated desc
PowerShell
# Security Arsenal IOC Hunt — SloppyRAT / PhantomCore / CastleLoader artifacts
# Run elevated on suspected endpoints or via your RMM/EDR live-response shell.

$Report = @()

# 1) Network: live connections to SloppyRAT C2 / TrueConf 4307
$net = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $_.RemotePort -eq 4307 -or $_.LocalPort -eq 4307
}
foreach ($c in $net) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $Report += [pscustomobject]@{Type='Network4307'; Local=$c.LocalAddress; Remote=$c.RemoteAddress; Process=$proc.ProcessName; Path=$proc.Path}
}

# 2) DNS cache check for SloppyRAT domains
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match 'skipraid\.com|truesmart\.org|polygon-rpc|matic'
}
foreach ($d in $dns) { $Report += [pscustomobject]@{Type='DNSCache'; Entry=$d.Entry; Data=$d.Data; Process=''; Path=''} }

# 3) Persistence: Run keys referencing PowerShell/download cradles (ClickFix/CastleLoader)
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-Item $k).Property | ForEach-Object {
            $v = (Get-ItemProperty -Path $k -Name $_).$_
            if ($v -match 'powershell|mshta|wscript|IEX|DownloadString|bitsadmin') {
                $Report += [pscustomobject]@{Type='RunKey'; Entry="$k\$_"; Data=$v; Process=''; Path=''}
            }
        }
    }
}

# 4) Scheduled tasks with suspicious actions
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $act = ($_ | Get-ScheduledTaskInfo) | Out-Null; $_
} | Where-Object { $_.Actions.Execute -match 'powershell|mshta|wscript' -and $_.TaskPath -notmatch 'Microsoft' } | ForEach-Object {
    $Report += [pscustomobject]@{Type='SchedTask'; Entry=$_.TaskName; Data=($_.Actions | Out-String).Trim(); Process=''; Path=$_.TaskPath}
}

# 5) TrueConf server: flag unexpected child processes of the server binary (post-exec as SYSTEM)
Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -match 'TrueConf|tcs_' -or ($_.CommandLine -match 'TrueConf' -and $_.Name -match 'cmd|powershell')
} | ForEach-Object {
    $Report += [pscustomobject]@{Type='TrueConfProc'; Entry=$_.Name; Data=$_.CommandLine; Process=$_.ProcessId; Path=$_.ExecutablePath}
}

# 6) Hash sweep against OTX SloppyRAT MD5s in common staging dirs
$iocHashes = @('1c15653d8428e69ff2cadf3a3a1f506f','5731f763100773be35669757b8accc95',
               '5966d07d4cb3a9241fe4df0ad70ad665','f52464f721825936cd1338eac49ece10')
$dirs = @("$env:TEMP","$env:APPDATA","$env:PROGRAMDATA","C:\Users\Public")
foreach ($dir in $dirs) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($iocHashes -contains $h.ToLower()) {
            $Report += [pscustomobject]@{Type='HashMatch'; Entry=$_.FullName; Data=$h; Process=''; Path=''}
        }
    }
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path ".\ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($Report.Count) findings exported."

Response Priorities

Immediate (0–4 hours)

  • Block skipraid.com, api.truesmart.org, and *.truesmart.org at DNS, egress proxy, and EDR network controls. Add all 144 file hashes from the three pulses to EDR blocklists and SIEM watchlists.
  • Hunt for established connections on port 4307/TCP against any TrueConf server, and for PowerShell/mshta/wscript children of explorer.exe (ClickFix pattern).
  • Inventory TrueConf deployments. If internet-facing, isolate immediately pending patch verification against KLCERT-26-057/058. Assume compromise of any server that was reachable pre-patch and image it rather than cleaning in place.
  • Alert banking/finance business units in Czechia, Poland, Slovakia, and Slovenia on the WindRelay vishing pattern — fraudsters calling as 'the bank' and directing app installs.

24 Hours

  • Credential & session verification: SloppyRAT is a foothold for ransomware; treat any detection as pre-ransom. Force credential resets for users on affected hosts, revoke active sessions/tokens, and review privileged account logons for lateral movement artifacts.
  • Retro-hunt 30 days of proxy/DNS logs for Polygon JSON-RPC endpoints from workstations — EtherHiding traffic is a near-zero-false-positive indicator.
  • Verify TrueConf client integrity: compare hashes of deployed client installers against vendor-published values; trojanized installers mean every workstation that 'updated' is suspect.

1 Week

  • Patch and segment TrueConf (and all video conferencing infrastructure) into a restricted management VLAN; block 4307/TCP from everything except defined client ranges.
  • Restrict user-run script execution: enforce PowerShell Constrained Language Mode + AppLocker/WDAC policies that block powershell.exe spawned from explorer.exe for standard users — this kills the ClickFix delivery model outright.
  • Deploy the Sigma rules and KQL queries above into production detection with tuned allowlists; add a standing analytic for blockchain-RPC egress.
  • Mobile threat defense for corporate Android fleets: block sideloaded APKs, alert on Accessibility Service grants to non-whitelisted apps, and brief help desks to never direct users to install software over the phone.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-malwarewindrelay-nfc-fraudsloppyrat-clickfixhead-mare-apttrueconf-exploitationandroid-banking-trojan

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action