{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Apex Accelerator campaign is a highly polished social engineering operation targeting crypto startups. A successful compromise leads to the loss of code and digital assets. This hunt ensures no persistent payloads or active exfiltration exist in the estate." }, "name": "Apex Accelerator Post-Delivery Execution and Evasion", "type": "investigation", "labels": [ "hunt", "attack.t1562.001", "attack.t1112", "attack.t1059.001", "attack.t1059.003", "attack.t1005", "attack.t1041", "attack.t1567", "command and control", "defense evasion", "execution", "exfiltration", "initial access", "persistence" ], "series": { "slug": "auditing-the-auditor-unmasking-apex-accelerator", "index": 2, "title": "Auditing the auditor: Unmasking Apex Accelerator", "total": 2 }, "related": [ { "hunt": "apex-npm-supply-chain-delivery", "reason": "This hunt targets the initial package installation and binary download phase.", "relation": "precedes" }, { "hunt": "apex-accelerator-npm-supply-chain", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "While a rule can catch specific Defender impairment commands, this hunt correlates Bun launcher execution with rare staging scripts and Telegram exfiltration. This phased chain of events distinguishes the Apex campaign from standard administrative activities.", "coverage": [ { "stage": "defense-evasion-registry-defender", "steps": [ "defender-evasion-registry" ], "status": "covered" }, { "stage": "powershell-vbs-staging", "steps": [ "rare-temp-scripts" ], "status": "covered" }, { "stage": "payload-malware-deployment", "steps": [ "malware-execution" ], "status": "covered" }, { "stage": "exfiltration-over-telegram", "steps": [ "exfiltration-connections" ], "status": "covered" }, { "stage": "supply-chain-npm-install", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" }, { "stage": "launcher-binary-execution", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" }, { "stage": "c2-command-retrieval", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Malicious npm Package Installation", "slug": "supply-chain-npm-install", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "@apexacc/cli", "@apexacc/audit", "apex.cjs", "audit.cjs" ] }, { "name": "Platform-Specific Binary Launch", "slug": "launcher-binary-execution", "tactic": "execution", "techniques": [ "T1204.002" ], "observables": [ "apex-windows-x64.exe", "apex-audit-windows-x64.exe", "apex-darwin-arm64", "apex-audit-darwin-arm64", "apex-bootstrap.ts", "main.ts" ] }, { "name": "Verification Server Callback", "slug": "c2-command-retrieval", "tactic": "command-and-control", "techniques": [ "T1071.001" ], "observables": [ "vrf.apexaccs.org", "apex-verify-darwin", "apex-audit-verify-darwin", "POST /api/v1/vrf" ] }, { "name": "Windows Defense Impairment", "slug": "defense-evasion-registry-defender", "tactic": "defense-evasion", "techniques": [ "T1562.001", "T1112" ], "observables": [ "VerifiedAndReputablePolicyState", "Add-MpPreference -ExclusionPath %USERPROFILE%\\.apex-audit", "UAC elevation requests on Windows 11" ] }, { "name": "Scripted Payload Staging", "slug": "powershell-vbs-staging", "tactic": "execution", "techniques": [ "T1059.001", "T1059.003" ], "observables": [ "_apex_run.vbs", "_audit_run.vbs", "_apex_run.ps1", "_audit_run.ps1", "drop.ps1", "WScript.Shell.Run", "powershell -NoProfile -ExecutionPolicy Bypass" ] }, { "name": "Info-Stealer and Backdoor Execution", "slug": "payload-malware-deployment", "tactic": "persistence", "techniques": [ "T1005" ], "observables": [ "bludness.exe", "install.exe", "exegis.exe", "updater_loader.exe", "CloudSyncD", "pi_natives.win32-x64-baseline.node" ] }, { "name": "Data Exfiltration", "slug": "exfiltration-over-telegram", "tactic": "exfiltration", "techniques": [ "T1041", "T1567" ], "observables": [ "Telegram API endpoints", "ZIP archive creation in temporary directories", "verify.apexfdn.xyz" ] } ], "summary": "The Apex Accelerator campaign uses malicious npm packages and a fake Web3 platform to target cryptocurrency startups with info-stealing malware. The attack chain involves a supply-chain delivery mechanism that fetches platform-specific executables (Bun/Rust) to retrieve and execute further payloads on Windows and macOS, ultimately exfiltrating data via Telegram." }, "severity": "high", "rationale": "Focus on developer workstations and hosts with npm installed. Pay particular attention to macOS endpoints due to the cross-platform nature of CloudSyncD.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using Bun-compiled launchers to stage PowerShell and VBScript payloads, impair local security controls, and deploy information stealers that exfiltrate data to Telegram.", "parameters": { "c2_domains": { "from": { "ref": "REF8801", "kind": "article", "observed": "2026-10-12" }, "type": "list[domain]", "default": [ "vrf.apexaccs.org", "verify.apexfdn.xyz" ], "description": "C2 domains for command retrieval and verification." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hosts to narrow the hunt; leave empty to scan the entire estate." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "staging_files": { "from": { "ref": "REF8801", "kind": "article", "observed": "2026-10-12" }, "type": "list[path]", "default": [ "_apex_run.ps1", "_audit_run.ps1", "_apex_run.vbs", "_audit_run.vbs", "drop.ps1" ], "description": "Script files used for staging the secondary payload." }, "malicious_binaries": { "from": { "ref": "REF8801", "kind": "article", "observed": "2026-10-12" }, "type": "list[string]", "default": [ "bludness.exe", "install.exe", "exegis.exe", "updater_loader.exe", "cloudsyncd", "apex-verify-darwin", "apex-audit-verify-darwin" ], "description": "Known malicious binary names from the report." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages", "name": "Elastic Security Labs \u2014 Auditing the auditor: Unmasking Apex Accelerator" } ], "blind_spots": [ { "id": "missing-endpoint-network-logs", "risk": "A generic network log may show Telegram traffic, but without process correlation, it could be dismissed as legitimate user activity.", "stage": "exfiltration-over-telegram", "question": "Which specific process exfiltrated data to Telegram on hosts missing socket-to-process telemetry?", "requires": "hb_network_connection with process correlation" }, { "id": "powershell-script-block-truncation", "risk": "Adversaries often use large encoded blocks that may exceed log limits, hiding the second-stage C2 URLs.", "stage": "powershell-vbs-staging", "question": "Can we recover the full encoded command from the staging script block?", "requires": "hb_script_activity with high retention" } ] }, "name": "Apex Accelerator Post-Delivery Execution and Evasion", "description": "This hunt targets the post-delivery phase of the Apex Accelerator campaign (REF8801). It identifies Windows security impairment, such as disabling Smart App Control and adding Defender exclusions, alongside the creation of rare staging scripts. The hunt then pivots to find the execution of secondary payloads like bludness.exe or CloudSyncD and identifies outbound exfiltration to Telegram or attacker-controlled domains. It uses a phased flow to first confirm the staging breachhead before examining the final exfiltration and malware persistence." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "auditing-the-auditor-unmasking-apex-accelerator", "index": 2, "title": "Auditing the auditor: Unmasking Apex Accelerator", "total": 2 }, "coverage": [ { "stage": "defense-evasion-registry-defender", "steps": [ "defender-evasion-registry" ], "status": "covered" }, { "stage": "powershell-vbs-staging", "steps": [ "rare-temp-scripts" ], "status": "covered" }, { "stage": "payload-malware-deployment", "steps": [ "malware-execution" ], "status": "covered" }, { "stage": "exfiltration-over-telegram", "steps": [ "exfiltration-connections" ], "status": "covered" }, { "stage": "supply-chain-npm-install", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" }, { "stage": "launcher-binary-execution", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" }, { "stage": "c2-command-retrieval", "reason": "Belongs to another part of the 'Auditing the auditor: Unmasking Apex Accelerator' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using Bun-compiled launchers to stage PowerShell and VBScript payloads, impair local security controls, and deploy information stealers that exfiltrate data to Telegram.", "blind_spots": [ { "id": "missing-endpoint-network-logs", "risk": "A generic network log may show Telegram traffic, but without process correlation, it could be dismissed as legitimate user activity.", "stage": "exfiltration-over-telegram", "question": "Which specific process exfiltrated data to Telegram on hosts missing socket-to-process telemetry?", "requires": "hb_network_connection with process correlation" }, { "id": "powershell-script-block-truncation", "risk": "Adversaries often use large encoded blocks that may exceed log limits, hiding the second-stage C2 URLs.", "stage": "powershell-vbs-staging", "question": "Can we recover the full encoded command from the staging script block?", "requires": "hb_script_activity with high retention" } ], "scoping_notes": "Focus on developer workstations and hosts with npm installed. Pay particular attention to macOS endpoints due to the cross-platform nature of CloudSyncD.", "beyond_detection": "While a rule can catch specific Defender impairment commands, this hunt correlates Bun launcher execution with rare staging scripts and Telegram exfiltration. This phased chain of events distinguishes the Apex campaign from standard administrative activities." } }, { "id": "scoping-bun-launchers", "type": "query", "label": "Scope Apex Bun launchers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%apex-windows-x64.exe' OR LOWER(process_name) LIKE '%apex-audit-windows-x64.exe' OR LOWER(process_name) LIKE '%apex-darwin-arm64' OR LOWER(process_name) LIKE '%apex-audit-darwin-arm64') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify hosts running the primary Apex or Audit binaries that serve as the entry point for the secondary execution chain.", "expected_signal": "A list of hosts running the Apex-branded Bun executables. Absence means the primary launchers have not been observed." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope Apex Bun launchers", "reads": [ "device_hostname", "process_cmd_line", "process_name", "time", "user_name" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%apex-windows-x64.exe' OR LOWER(process_name) LIKE '%apex-audit-windows-x64.exe' OR LOWER(process_name) LIKE '%apex-darwin-arm64' OR LOWER(process_name) LIKE '%apex-audit-darwin-arm64') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts running the Apex-branded Bun executables. Absence means the primary launchers have not been observed.", "verified": "dry-run", "verified_at": "2026-10-13" } }, { "id": "defender-evasion-registry", "type": "query", "label": "Identify security impairment", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE ((LOWER(reg_target) LIKE '%\\\\verifiedandreputablepolicystate%' AND reg_value_data = '0') OR (LOWER(reg_target) LIKE '%\\\\exclusions\\\\\\\\paths%' AND LOWER(reg_value_data) LIKE '%.apex-audit%')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Find evidence of Smart App Control disabling or Defender exclusion path additions used by Apex.", "expected_signal": "Registry writes disabling Smart App Control or adding the .apex-audit path to Defender's exclusion list." }, "parents": [ { "id": "scoping-bun-launchers" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Identify security impairment", "reads": [ "device_hostname", "process_name", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, process_name, time FROM hb_registry_activity WHERE ((LOWER(reg_target) LIKE '%\\\\verifiedandreputablepolicystate%' AND reg_value_data = '0') OR (LOWER(reg_target) LIKE '%\\\\exclusions\\\\\\\\paths%' AND LOWER(reg_value_data) LIKE '%.apex-audit%')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Registry writes disabling Smart App Control or adding the .apex-audit path to Defender's exclusion list.", "verified": "dry-run", "verified_at": "2026-10-13" } }, { "id": "rare-temp-scripts", "type": "query", "label": "Detect rare staging scripts", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(file_name) AS name, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS touches, MIN(time) AS first_seen FROM hb_file_activity WHERE instr(',' || '{{staging_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING hosts <= 5", "surface": "hb_file_activity", "description": "Find temporary PowerShell and VBScript files used to launch the verification commands, stack-counting across the fleet.", "expected_signal": "Script files like _apex_run.vbs occurring on very few hosts. Fleet-wide files are likely legitimate and should be ignored." }, "parents": [ { "id": "scoping-bun-launchers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Detect rare staging scripts", "reads": [ "device_hostname", "file_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT LOWER(file_name) AS name, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS touches, MIN(time) AS first_seen FROM hb_file_activity WHERE instr(',' || '{{staging_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING hosts <= 5", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Script files like _apex_run.vbs occurring on very few hosts. Fleet-wide files are likely legitimate and should be ignored.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_name" ], "rare_below": 5 }, "verified_at": "2026-10-13" } }, { "id": "agent-triage-early", "type": "analytic", "label": "Triage early staging activity", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "scoping-bun-launchers", "defender-evasion-registry", "rare-temp-scripts" ], "objective": "Determine if Apex-branded launchers have successfully initiated script-based staging and defense evasion on the scoped hosts.", "description": "Assess whether the Bun launchers and the observed staging/evasion activity indicate a successful breachhead.", "max_iterations": 4, "expected_signal": "A per-host verdict confirming staging activity.", "success_criteria": "A verdict per host with citations of specific file or registry rows." }, "parents": [ { "id": "defender-evasion-registry", "kind": "merge" }, { "id": "rare-temp-scripts", "kind": "merge" } ] }, { "id": "malware-execution", "type": "query", "label": "Detect malware binary execution", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (instr(',' || '{{malicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%cloudsyncd%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the execution of final payload binaries like bludness.exe or CloudSyncD on scoped hosts.", "expected_signal": "Processes named bludness.exe or CloudSyncD running on the same hosts that performed staging. High-confidence indicators of infection." }, "parents": [ { "id": "agent-triage-early" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Detect malware binary execution", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_name", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (instr(',' || '{{malicious_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_path) LIKE '%cloudsyncd%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Processes named bludness.exe or CloudSyncD running on the same hosts that performed staging. High-confidence indicators of infection.", "verified": "dry-run", "verified_at": "2026-10-13" } }, { "id": "exfiltration-connections", "type": "query", "label": "Identify Telegram and C2 exfiltration", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, dst_endpoint_ip, time FROM hb_network_connection WHERE (LOWER(dst_endpoint_hostname) LIKE '%api.telegram.org%' OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Detect network traffic to Telegram API or Apex verification domains from scoped hosts.", "expected_signal": "Connections to Telegram or Apex domains. Silence suggests the infection has not reached the exfiltration phase." }, "parents": [ { "id": "agent-triage-early" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Identify Telegram and C2 exfiltration", "reads": [ "device_hostname", "dst_endpoint_hostname", "dst_endpoint_ip", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_hostname, dst_endpoint_ip, time FROM hb_network_connection WHERE (LOWER(dst_endpoint_hostname) LIKE '%api.telegram.org%' OR instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Connections to Telegram or Apex domains. Silence suggests the infection has not reached the exfiltration phase.", "verified": "dry-run", "verified_at": "2026-10-13" } }, { "id": "agent-triage-final", "type": "analytic", "label": "Synthesize end-to-end evidence", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "agent-triage-early", "malware-execution", "exfiltration-connections" ], "objective": "Determine if the identified staging led to successful deployment of stealers and active exfiltration of data.", "description": "Combine the early staging verdict with the follow-on malware and exfiltration evidence for a final assessment.", "max_iterations": 6, "expected_signal": "A comprehensive verdict per host across the full attack chain.", "success_criteria": "A final malicious verdict for any host where staging leads to payload execution or exfiltration." }, "parents": [ { "id": "malware-execution", "kind": "merge" }, { "id": "exfiltration-connections", "kind": "merge" } ] }, { "id": "route-final-verdict", "type": "checkpoint", "label": "Route on final verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-triage-final verdict is malicious for at least one host", "condition": "the agent-triage-final verdict is malicious for at least one host", "blind_spot": "missing-endpoint-network-logs", "confidence": "high", "description": "Direct the hunt to containment or close-out based on the agent's synthesis.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage-final" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further exfiltration by isolating the affected endpoint.", "instructions": "Isolate the host and initiate IR procedures. Collect ZIP files from temporary directories for analysis.", "action_approval": "required" }, "parents": [ { "id": "route-final-verdict", "branch": "on_supports" } ] }, { "id": "analyst-remediation-review", "type": "task", "label": "Analyst remediation review", "config": { "assignee": "analyst", "description": "Confirm the agent's verdict and verify successful containment.", "instructions": "Review the process tree and network connections associated with the Bun launchers. Confirm if the Telegram traffic is malicious." }, "parents": [ { "id": "route-final-verdict", "branch": "default" }, { "id": "route-final-verdict", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Record findings and update detection requirements.", "instructions": "Document all IOCs and update the npm supply-chain monitor to alert on future Apex packages." }, "parents": [ { "id": "route-final-verdict", "branch": "on_refutes" }, { "id": "analyst-remediation-review" } ] } ] }