YuanKong Android RAT + TraderTraitor (DPRK) FLATROOF/ROOFDECK Backdoors: OTX Pulse Analysis — Enterprise Detection Pack

---
title: TraderTraitor / YuanKong Known C2 Domain Resolution
id: 9f3a2c71-4b6e-4d2a-9c51-tradertraitor001
status: experimental
description: Detects DNS resolution or proxy requests to known TraderTraitor (FLATROOF/ROOFDECK/macOS.Gaslight) and YuanKong Android RAT command-and-control infrastructure identified in OTX pulses dated 2026-10-19.
author: Security Arsenal Threat Intelligence
logsource:
  category: dns
product: windows
detection:
  selection:
    query|contains:
      - 'ktx123.net'
      - 'ktxapp.com'
      - 'technicais.sytes.net'
      - 'storage.hubpage.cloud'
  condition: selection
falsepositives:
  - Threat intelligence platform enrichment lookups
  - Sandbox detonation traffic
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1102
date: 2026/10/19
references:
  - https://otx.alienvault.com
---
title: Suspicious Terraform Execution by Non-DevOps Process or User Context
id: 7c1d9e44-2a8f-4b3c-8e62-terraform002
status: experimental
description: Detects Terraform binary execution spawned from unusual parent processes (office apps, browsers, script interpreters) consistent with TraderTraitor weaponized Terraform social engineering of DevOps personnel.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\terraform.exe'
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\chrome.exe'
      - '\OUTLOOK.EXE'
      - '\slack.exe'
      - '\Code.exe'
  filter_legit_cicd:
    ParentImage|endswith:
      - '\terraform.exe'
      - '\bash.exe'
  condition: selection_img and selection_parent and not filter_legit_cicd
falsepositives:
  - Engineers running terraform plan/apply manually from shells
  - IDE-integrated Terraform extensions
level: medium
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
date: 2026/10/19
references:
  - https://otx.alienvault.com
---
title: Cloud API Token Abuse - Mass IAM or Secrets Enumeration After Interactive Login
id: 3e8b5f12-9d4c-4a1e-b7d3-cloudapi003
status: experimental
description: Detects rapid sequence of cloud CLI enumeration commands (IAM, secrets, state inspection) within a short window on an endpoint, consistent with TraderTraitor post-compromise API abuse following FLATROOF/ROOFDECK deployment.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\aws.exe'
      - '\az.exe'
      - '\gcloud.exe'
  selection_cmd:
    CommandLine|contains:
      - 'iam list-'
      - 'secretsmanager'
      - 'get-secret-value'
      - 'ssm get-parameter'
      - 'keyvault secret'
      - 's3 ls'
      - 'sts get-caller-identity'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate DevOps automation scripts
  - Cloud inventory tooling
level: medium
tags:
  - attack.discovery
  - attack.t1069
  - attack.t1552
  - attack.credential_access
date: 2026/10/19
references:
  - https://otx.alienvault.com

// TraderTraitor & YuanKong IOC Hunt — Microsoft Sentinel / Defender XDR
// Covers network C2 indicators and known malicious file hashes from OTX pulses 2026-10-19
let C2Domains = dynamic(["ktx123.net", "www.ktx123.net", "www.ktxapp.com", "technicais.sytes.net", "storage.hubpage.cloud"]);
let C2IPs = dynamic(["206.82.1.14"]);
let MalHashes = dynamic([
    "73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387",
    "af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9",
    "675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1",
    "77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca",
    "4280a408a7f0490d9d2eaa3f536f339b",
    "d95dede4387ff516f4c23351c450427d"
]);
let Lookback = 14d;
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (C2Domains) or RemoteIP in (C2IPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType;
let DnsHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where isnotempty(RemoteUrl)
    | where RemoteUrl endswith ".sytes.net"  // DDNS subdomain anomaly from eng workstations
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl;
let FileHits = DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in (MalHashes) or MD5 in (MalHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessFileName;
let TerraformAbuse = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "terraform.exe"
    | where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe", "slack.exe", "OUTLOOK.EXE", "chrome.exe")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
union NetworkHits, DnsHits, FileHits, TerraformAbuse
| sort by TimeGenerated desc

# Security Arsenal — YuanKong / TraderTraitor IOC Hunt Script
# Run elevated on endpoints; outputs hits to console and CSV
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- Known IOCs from OTX pulses (2026-10-19) ---
$badDomains = @('ktx123.net','www.ktx123.net','www.ktxapp.com','technicais.sytes.net','storage.hubpage.cloud')
$badIPs     = @('206.82.1.14')
$badHashes  = @(
  '73cbe8e3730cacfdd208f22eab468bb5495a78c0eb2cb37eff5af0cafe321387',
  'af92f7d616564dabffb0679a1a38fb24d6a6c4e4a90114c6eb0834c57dd456c9',
  '675d083b63e2169e8fd0ac0cfd27904005b5e2be00f6e3489f6e47fc4c57a4d1',
  '77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca'
)

# --- 1. Active/recent network connections to C2 ---
Write-Host '[*] Checking active TCP connections against C2 indicators...' -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
  $report += [PSCustomObject]@{ Type='NetworkC2'; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)]"; Host=$env:COMPUTERNAME }
}

# --- 2. DNS client cache for C2 domain resolutions ---
Write-Host '[*] Checking DNS cache for C2 domain resolutions...' -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
  $report += [PSCustomObject]@{ Type='DNSCache'; Detail="$($_.Entry) -> $($_.Data)"; Host=$env:COMPUTERNAME }
}

# --- 3. Hash sweep of common staging/drop directories ---
Write-Host '[*] Hashing files in staging directories (this may take a while)...' -ForegroundColor Cyan
$paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", 'C:\ProgramData')
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -lt 100MB } | ForEach-Object {
      $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
      if ($badHashes -contains $h) {
        $report += [PSCustomObject]@{ Type='MaliciousFile'; Detail="$($_.FullName) [SHA256:$h]"; Host=$env:COMPUTERNAME }
      }
    }
}

# --- 4. Terraform execution artifacts (TraderTraitor weaponized IaC) ---
Write-Host '[*] Checking for suspicious Terraform artifacts...' -ForegroundColor Cyan
$tfDirs = Get-ChildItem -Path "$env:USERPROFILE" -Recurse -Directory -Filter '.terraform' -ErrorAction SilentlyContinue
foreach ($d in $tfDirs) {
  if ($d.FullName -notlike '*workspace*' -and $d.LastWriteTime -gt (Get-Date).AddDays(-30)) {
    $report += [PSCustomObject]@{ Type='TerraformArtifact'; Detail="Recently initialized .terraform dir: $($d.FullName) (modified $($d.LastWriteTime))"; Host=$env:COMPUTERNAME }
  }
}

# --- 5. Suspicious scheduled tasks (backdoor persistence) ---
Write-Host '[*] Enumerating non-Microsoft scheduled tasks...' -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' } | ForEach-Object {
  $action = ($_.Actions | Select-Object -First 1).Execute
  if ($action -match 'powershell|cmd|wscript|mshta|rundll32|terraform') {
    $report += [PSCustomObject]@{ Type='SuspiciousTask'; Detail="$($_.TaskName) -> $action"; Host=$env:COMPUTERNAME }
  }
}

# --- Output ---
if ($report.Count -gt 0) {
  $report | Format-Table -AutoSize
  $report | Export-Csv -Path ".\ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
  Write-Host "[!] $($report.Count) indicator hit(s) found — escalate to IR immediately." -ForegroundColor Red
} else {
  Write-Host '[+] No indicators matched on this host.' -ForegroundColor Green
}