Woodgnat IAB & Kimsuky Campaigns: Mistic Backdoor, JINX-0164 macOS RATs, and LOTS Abuse Analysis

---
title: Potential Woodgnat Mistic Backdoor C2 Activity
id: d2f1b8c5-6a7e-4b8c-9d1e-3f5a7b6c8d9e
description: Detects network connections to known Woodgnat C2 infrastructure associated with Mistic Backdoor and ModeloRAT.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6756a1c89b5d4b1c8a7d9e0f
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'authorized-logins.net'
            - 'grande-luna.top'
            - 'human-check.top'
            - 'update-fall.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - c2
    - backdoor
    - apt
    - woodgnat
---
title: Potential JINX-0164 macOS Infrastructure Access
id: e3g2c9d6-7b8f-5c9d-0e2f-4g6b8c7d9e0f1
description: Detects DNS queries or network connections to domains used by JINX-0164 for macOS malware delivery.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6758a2d90c6e5c2d9b8e0f1a
logsource:
    category: dns
    product: zeek
detection:
    selection:
        query|contains:
            - 'driver-updater.net'
            - 'live.us.org'
            - 'teamicrosoft.com'
            - 'live.ong'
    condition: selection
falsepositives:
    - Legitimate typos (unlikely for these specific domains)
level: high
tags:
    - dns
    - osx
    - trojan
    - jinx-0164
---
title: Kimsuky KimJongRAT LOTS Activity via GitHub
id: f4h3d0e7-8c0g-6d0e-1f3g-5h7c9d0e1f2g3
description: Detects processes reaching out to suspicious domains used by Kimsuky for GitHub abuse and MeshAgent C2.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6759b3e11d7f6d3e0c9f1g2b
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationHostname|endswith:
            - 'corpsecs.com'
            - 'servequake.com'
    condition: selection
falsepositives:
    - Rare
level: critical
tags:
    - c2
    - apt
    - kimsuky
    - lateral-movement


kql
// Hunt for Woodgnat, JINX-0164, and Kimsuky Network Indicators
// Table: DeviceNetworkEvents (Microsoft Sentinel)
let IOC_Domains = dynamic([
    'authorized-logins.net', 'mueleer.com', 'grande-luna.top', 
    'driver-updater.net', 'teamicrosoft.com', 'live.ong',
    'googleoba.servequake.com', 'corpsecs.com'
]);
let IOC_IPs = dynamic([
    '89.36.224.5', '104.200.67.46'
]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOC_Domains) or RemoteIP in (IOC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatActor = case(
    RemoteUrl has 'authorized-logins.net' or RemoteUrl has 'grande-luna.top', 'Woodgnat',
    RemoteUrl has 'driver-updater.net' or RemoteUrl has 'teamicrosoft.com', 'JINX-0164',
    RemoteUrl has 'servequake.com' or RemoteUrl has 'corpsecs.com', 'Kimsuky',
    'Unknown'
)


powershell
# IOC Hunt Script for Woodgnat, JINX-0164 (Windows artifacts if any), and Kimsuky
# Requires Administrative Privileges

Write-Host "[*] Starting Hunt for Woodgnat/Kimsuky Persistence and IOCs..." -ForegroundColor Cyan

# 1. Check for suspicious File Hashes (Simulated paths or user provided directories)
$TargetHashes = @(
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", # Woodgnat Mistic
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", # JINX-0164
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470", # Kimsuky KimJongRAT
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"  # Kimsuky MeshAgent
)

$SearchPaths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp\")

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Write-Host "[*] Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $TargetHashes -contains $_.Hash } | ForEach-Object {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
        }
    }
}

# 2. Check for suspicious Registry Persistence (Run Keys)
Write-Host "[*] Checking Registry Run Keys for suspicious entries..." -ForegroundColor Yellow
$RunKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

$suspicousNames = @("update", "loader", "mints", "agent", "mesh")

foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue | Get-Member | Where-Object { $_.MemberType -eq "NoteProperty" -and $_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" -and $_.Name -ne "PSChildName" } | ForEach-Object {
            $PropName = $_.Name
            $PropValue = (Get-ItemProperty -Path $Key).$PropName
            if ($suspicousNames | Where-Object { $PropValue -like "*$_*" }) {
                Write-Host "[!] Suspicious Persistence: $Key | Property: $PropName | Value: $PropValue" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Hunt Complete." -ForegroundColor Green