ZimReaper, wp2shell, and IOCONTROL: OTX Pulse Analysis — Critical Infrastructure Threat Pack

title: Potential TA488 ZimReaper DNS Tunneling
id: 00000000-0000-0000-0000-000000000001
description: Detects suspicious high entropy DNS queries characteristic of the ZimReaper malware DNS tunneling activity observed in TA488 campaigns.
status: experimental
date: 2026/07/24
author: Security Arsenal
logsource:
    category: dns
    product: zeek
detection:
    selection:
        query|contains: '.'
    filter:
        query|endswith:
            - '.com'
            - '.net'
            - '.org'
    condition: selection and not filter
    # Note: In a real environment, use entropy calculation > 3.5 or length > 52
fields:
    - id.orig_h
    - id.resp_h
    - query
falsepositives:
    - Legitimate high-entropy subdomains
level: high
tags:
    - attack.exfiltration
    - attack.command_and_control
    - attack.t1048
    - attack.t1071
---
title: WordPress wp2shell Exploitation Attempt
description: Detects potential exploitation of CVE-2026-63030 (wp2shell) targeting WordPress batch API or plugin upload mechanisms.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        c-uri|contains:
            - '/wp-admin/admin-ajax.php'
            - '/wp-/wp/v2/'
    selection_method:
        c-method: POST
    selection_keywords:
        cs-method: POST
        c-uri|contains:
            - 'cmsmap'
            - 'plugin_upload'
            - 'eval('
    condition: selection_uri and selection_method and selection_keywords
falsepositives:
    - Legitimate plugin management
level: critical
tags:
    - attack.initial_access
    - attack.webshell
    - attack.t1190
---
title: Cyber Av3ngers IOCONTROL C2 Activity
description: Detects network connections to known Cyber Av3ngers infrastructure associated with IOCONTROL malware targeting US critical infrastructure PLCs.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|contains:
            - '79.133.46.209'
            - '172.235.128.52'
            - '79.177.131.206'
    condition: selection
fields:
    - ProcessName
    - DestinationIp
    - DestinationPort
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.industrial_control_systems
    - attack.t0885


kql
// Hunt for wp2shell and ZimReaper IOCs
DeviceProcessEvents
| where InitiatingProcessFileName in ("w3wp.exe", "java.exe", "php-cgi.exe", "nginx.exe")
| where SHA1 in (
    "2a1410d8e2a8337ac2171cedea8c0fdc47c647a0",
    "58eca847e9eae9e6b08cc211f1559817b71bc4cc",
    "d9a220c8039f1c4d72cae7ccb8b3a33dec8815be",
    "e9756e2338f84746007235e4cab7a70d5b3ca47f",
    "ebea44890f434d5d67ede22009a3f4bb5cac33f8",
    "95bd07b4400095acdafce05888da27228d7d07ca",
    "366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb"
) 
or MD5 in ("c010f64080b0b0997b362a8e6b9c618e");

// Hunt for Network Connections to Cyber Av3ngers Infrastructure
DeviceNetworkEvents
| where RemoteIP in ("79.133.46.209", "172.235.128.52", "79.177.131.206")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl;

// Hunt for DNS resolution of TA488 domains
DeviceNetworkEvents
| where ActionType == "DnsQuery"
| where RemoteUrl has_any (
    "zimbra-metadata.com", "emailanalytics.com.ua", "mailnalysis.com", 
    "analyticemailmeter.com", "zimbrastat.com", "zimbrasoft.com.ua",
    "ocferda.com", "tylarion867mino.com"
)


powershell
<#
.SYNOPSIS
    IOC Hunt Script for ZimReaper, wp2shell, and Cyber Av3ngers
.DESCRIPTION
    Scans the file system for known malware hashes and checks DNS cache for C2 domains.
#>

$Hashes = @{
    "MD5"  = @("c010f64080b0b0997b362a8e6b9c618e")
    "SHA1" = @(
        "2a1410d8e2a8337ac2171cedea8c0fdc47c647a0", "58eca847e9eae9e6b08cc211f1559817b71bc4cc",
        "d9a220c8039f1c4d72cae7ccb8b3a33dec8815be", "e9756e2338f84746007235e4cab7a70d5b3ca47f",
        "ebea44890f434d5d67ede22009a3f4bb5cac33f8", "95bd07b4400095acdafce05888da27228d7d07ca",
        "366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb"
    )
}

$Domains = @(
    "zimbra-metadata.com", "emailanalytics.com.ua", "mailnalysis.com", 
    "analyticemailmeter.com", "zimbrastat.com", "zimbrasoft.com.ua",
    "ocferda.com", "tylarion867mino.com"
)

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# 1. File Hash Scan
Write-Host "Scanning for malicious file hashes..." -ForegroundColor Yellow
$DrivesToScan = @("C:", "D:", "E:")

foreach ($Drive in $DrivesToScan) {
    if (Test-Path $Drive) {
        Write-Host "Scanning drive $Drive..."
        try {
            Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Get-FileHash -ErrorAction SilentlyContinue | Where-Object {
                $_.Hash -in $Hashes['SHA1'] -or $_.Hash -in $Hashes['MD5']
            } | ForEach-Object {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | $($_.Hash) | $($_.Algorithm)" -ForegroundColor Red
            }
        } catch {
            # Ignore access errors
        }
    }
}

# 2. DNS Cache Check
Write-Host "Checking DNS Cache for malicious domains..." -ForegroundColor Yellow
$DnsCache = Get-DnsClientCache
foreach ($Domain in $Domains) {
    $Entries = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Entries) {
        Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND: $Domain" -ForegroundColor Red
        $Entries | Format-List
    }
}

Write-Host "Hunt complete." -ForegroundColor Green