Woodgnat Access Broker & GhostShell Supply Chain: Mistic Backdoor, Vidar Stealer, and Middle East C2 Infrastructure

title: Potential Woodgnat Sideloading Activity - Mistic Backdoor
id: 6f3a2b1c-8d4e-4a5f-9e10-1b2c3d4e5f6g
description: Detects potential sideloading behavior used by Woodgnat to deploy Mistic backdoor via suspicious DLL loading from non-standard paths.
status: experimental
date: 2026/06/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67891011/
tags:
    - attack.defense_evasion
    - attack.t1574.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\svchost.exe'
            - '\regsvr32.exe'
        CommandLine|contains: '.dll'
    filter_legit:
        ParentImage|contains:
            - '\Windows\System32\'
            - '\Program Files\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installations
level: high
---
title: GhostShell Supply Chain Attack - Besomar Decoy Execution
id: 7g4h5i6j-7k8l-9m0n-1o2p-3q4r5s6t7u8v
description: Detects execution of processes originating from archives containing filenames impersonating Besomar UAV documents.
status: experimental
date: 2026/06/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/11223344/
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\mshta.exe'
        ParentImage|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
        CommandLine|contains:
            - 'Besomar'
            - 'Interceptor'
            - 'UAV'
            - 'Drone_Spec'
    condition: selection
falsepositives:
    - Legitimate access to defense industry documents
level: critical
---
title: Exploitation Attempt - CVE-2025-11953
id: 8w9x0y1z-2a3b-4c5d-6e7f-8g9h0i1j2k3l
description: Detects potential exploitation attempts associated with the Middle East C2 infrastructure campaign.
status: experimental
date: 2026/06/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/55667788/
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: web
    product: apache
    service: access
detection:
    selection_uri:
        UriQuery|contains:
            - '/CVE-2025-11953'
            - 'exploit'
    selection_status:
        StatusCode|startswith:
            - '200'
            - '500'
    condition: all of selection_*
falsepositives:
    - Security scans
level: high


kql
// Hunt for GhostShell Vidar Stealer Hashes and Process Activity
let MaliciousHashes = pack_array(
  "ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3",
  "8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25",
  "b1834634820ae696f0514ca2b6723061f115857232306e573f4d115bc6ead012"
);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (MaliciousHashes)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| union (
  DeviceNetworkEvents
  | where Timestamp > ago(7d)
  | where RemoteUrl has_any (
      "mail.authorized-logins.net", "mueleer.com", "grande-luna.top", 
      "oeannon.com", "thomphon.com", "human-check.top", "update.update-fall.com"
    )
  | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
)


powershell
# IOC Hunt Script for Woodgnat and GhostShell Activity
# Requires Admin Privileges

Write-Host "[*] Starting Hunt for Woodgnat/GhostShell IOCs..." -ForegroundColor Cyan

# 1. Check for malicious file hashes on system
$TargetHashes = @(
    "ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3",
    "8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be"
)

$Drives = Get-PSDrive -PSProvider FileSystem
foreach ($Drive in $Drives) {
    Write-Host "[*] Scanning drive:" $Drive.Root
    Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { !$_.PSIsContainer } | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $Hash) {
            Write-Host "[!] MALICIOUS FILE FOUND:" $_.FullName -ForegroundColor Red
        }
    }
}

# 2. Check for suspicious Scheduled Tasks (Persistence Mechanism)
Write-Host "[*] Checking for suspicious scheduled tasks..."
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or 
    $_.Actions.Execute -like "*rundll32*" 
} | Select-Object TaskName, TaskPath, Actions | Format-Table

# 3. Network Connection Check for Woodgnat Domains
$BadDomains = @(
    "mail.authorized-logins.net", "mueleer.com", "grande-luna.top",
    "oeannon.com", "thomphon.com", "human-check.top"
)

Write-Host "[*] Checking active network connections for C2 domains..."
Get-NetTCPConnection | Select-Object LocalAddress, RemoteAddress, OwningProcess | 
    ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($Process) {
            $RemoteHostName = Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue | Select-Object -ExpandProperty NameHost
            if ($BadDomains -contains $RemoteHostName) {
                Write-Host "[!] C2 CONNECTION DETECTED:" $Process.ProcessName "connected to" $RemoteHostName -ForegroundColor Red
            }
        }
    }