{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Public-facing mail servers are strategic beachheads for APT groups. This hunt proactively searches for their exploitation and a novel AI-evasion technique that could bypass automated security analysis." }, "name": "MDaemon Exploitation and Backdoor Lifecycle", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1566", "attack.t1059", "attack.t1027", "attack.t1555", "credential access", "defense evasion", "execution", "initial access" ], "series": { "slug": "eset-apt-activity-report-q2-2026-q3-2026", "index": 2, "title": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "total": 2 }, "related": [ { "hunt": "developer-credential-harvesting-supply-chain", "reason": "This hunt focuses on the mail server and phishing paths; supply chain injection via developer tokens is handled separately.", "relation": "out-of-scope-alternative" }, { "hunt": "development-pipeline-credential-abuse-injection", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A simple rule could look for a specific filename, but this hunt correlates MDaemon exposure, anomalous authentication from rare IPs, and a novel behavioral decoy across three surfaces, requiring analyst context to differentiate between legitimate script comments and evasion tradecraft.", "coverage": [ { "stage": "initial-access-mdaemon-exploit", "steps": [ "scope-mdaemon-servers", "mdaemon-exploit-leads" ], "status": "covered" }, { "stage": "initial-access-recruitment-phishing", "steps": [ "phishing-access-leads" ], "status": "covered" }, { "stage": "execution-backdoor-deployment", "steps": [ "backdoor-execution" ], "status": "covered" }, { "stage": "defense-evasion-llm-safety-trigger", "steps": [ "evasion-decoys" ], "status": "covered" }, { "stage": "credential-access-developer-harvesting", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-supply-chain-injection", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "MDaemon Mail Server Exploitation", "slug": "initial-access-mdaemon-exploit", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "MDaemon mail servers", "HELLAGE backdoor", "HELLTAG backdoor" ] }, { "name": "Recruitment-Themed Phishing", "slug": "initial-access-recruitment-phishing", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "recruitment-themed social engineering", "AI-generated phishing lure images" ] }, { "name": "Developer Credential Harvesting", "slug": "credential-access-developer-harvesting", "tactic": "credential-access", "techniques": [ "T1555" ], "observables": [ "harvesting developer credentials", "private source code repositories" ] }, { "name": "Source Code Injection", "slug": "initial-access-supply-chain-injection", "tactic": "initial-access", "techniques": [ "T1195" ], "observables": [ "injecting malicious code into public and private source code repositories" ] }, { "name": "Backdoor Execution", "slug": "execution-backdoor-deployment", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "PteroBox", "PteroPSDoor", "Rezzuar", "HELLAGE", "HELLTAG" ] }, { "name": "AI Guardrail Evasion Decoy", "slug": "defense-evasion-llm-safety-trigger", "tactic": "defense-evasion", "techniques": [ "T1027" ], "observables": [ "decoy request for instructions on building a nuclear weapon into a script comment" ] } ], "summary": "APT groups in Q2-Q3 2026 targeted development environments via credential harvesting and source code injection, exploited MDaemon mail servers to deploy backdoors, and utilized AI-generated content and decoys for social engineering and defense evasion. Notable activities include North Korean DeceptiveDevelopment's supply chain attacks and the first documented destructive operation by Belarus-aligned FrostyNeighbor." }, "severity": "high", "rationale": "The hunt begins by identifying every host running MDaemon. If no MDaemon servers are present, the hunt still examines sign-in patterns and post-exploitation signals across the general estate.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has exploited a public-facing MDaemon mail server or successfully phished a user, subsequently deploying a backdoor and using script-based decoys to evade security analysis by triggering AI safety guardrails.", "parameters": { "scope_hosts": { "from": { "ref": "scoping-step", "kind": "manual", "observed": "2026-10-28" }, "type": "list[host]", "default": [], "description": "Hostnames running MDaemon; leave empty to hunt the whole estate." }, "lookback_days": { "from": { "ref": "standard hunt lookback", "kind": "manual", "observed": "2026-10-28" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "backdoor_names": { "from": { "ref": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "kind": "article", "observed": "2026-10-28" }, "type": "list[string]", "default": [ "hellage.exe", "helltag.exe", "pterobox.exe", "pteropsdoor.exe" ], "description": "Malware process names named in the ESET report." }, "evasion_decoys": { "from": { "ref": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "kind": "article", "observed": "2026-10-28" }, "type": "list[string]", "default": [ "nuclear weapon", "atomic bomb", "building a nuclear weapon" ], "description": "Decoy strings used in script comments to trigger AI safety guardrails." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026/", "name": "ESET APT Activity Report Q2 2026\u2013Q3 2026" } ], "blind_spots": [ { "id": "encrypted-http-traffic", "risk": "An exploitation attempt may appear as normal POST traffic without visibility into the encrypted body.", "stage": "initial-access-mdaemon-exploit", "question": "What was the payload inside the POST request?", "requires": "TLS inspection or server-side logs" }, { "id": "script-logging-missing", "risk": "Without PowerShell Script Block Logging, the decoy comments used for evasion will not be visible to the hunt.", "stage": "defense-evasion-llm-safety-trigger", "question": "Was the nuclear decoy present in the executed script?", "requires": "hb_script_activity with full block logging" } ] }, "name": "MDaemon Exploitation and Backdoor Lifecycle", "description": "This hunt tracks the lifecycle of recent APT activity targeting mail servers and software developers. It first scopes the estate for MDaemon installations, then examines HTTP traffic for exploitation attempts and sign-in anomalies. The second phase pivots to endpoint telemetry to find execution of known backdoor families like HELLAGE and HELLTAG, while specifically searching for a novel defense evasion technique where script comments contain nuclear-themed decoys designed to trip Large Language Model (LLM) safety guardrails and prevent security inspection." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "eset-apt-activity-report-q2-2026-q3-2026", "index": 2, "title": "ESET APT Activity Report Q2 2026\u2013Q3 2026", "total": 2 }, "coverage": [ { "stage": "initial-access-mdaemon-exploit", "steps": [ "scope-mdaemon-servers", "mdaemon-exploit-leads" ], "status": "covered" }, { "stage": "initial-access-recruitment-phishing", "steps": [ "phishing-access-leads" ], "status": "covered" }, { "stage": "execution-backdoor-deployment", "steps": [ "backdoor-execution" ], "status": "covered" }, { "stage": "defense-evasion-llm-safety-trigger", "steps": [ "evasion-decoys" ], "status": "covered" }, { "stage": "credential-access-developer-harvesting", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" }, { "stage": "initial-access-supply-chain-injection", "reason": "Belongs to another part of the 'ESET APT Activity Report Q2 2026\u2013Q3 2026' series.", "status": "out_of_scope" } ], "rationale": "An adversary has exploited a public-facing MDaemon mail server or successfully phished a user, subsequently deploying a backdoor and using script-based decoys to evade security analysis by triggering AI safety guardrails.", "blind_spots": [ { "id": "encrypted-http-traffic", "risk": "An exploitation attempt may appear as normal POST traffic without visibility into the encrypted body.", "stage": "initial-access-mdaemon-exploit", "question": "What was the payload inside the POST request?", "requires": "TLS inspection or server-side logs" }, { "id": "script-logging-missing", "risk": "Without PowerShell Script Block Logging, the decoy comments used for evasion will not be visible to the hunt.", "stage": "defense-evasion-llm-safety-trigger", "question": "Was the nuclear decoy present in the executed script?", "requires": "hb_script_activity with full block logging" } ], "scoping_notes": "The hunt begins by identifying every host running MDaemon. If no MDaemon servers are present, the hunt still examines sign-in patterns and post-exploitation signals across the general estate.", "beyond_detection": "A simple rule could look for a specific filename, but this hunt correlates MDaemon exposure, anomalous authentication from rare IPs, and a novel behavioral decoy across three surfaces, requiring analyst context to differentiate between legitimate script comments and evasion tradecraft." } }, { "id": "scope-mdaemon-servers", "type": "query", "label": "Scope MDaemon installations", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mdaemon%' OR LOWER(install_path) LIKE '%mdaemon%')", "surface": "hb_software_inventory", "description": "Identify hosts running MDaemon to narrow the search for exploitation leads.", "expected_signal": "A list of hosts hosting MDaemon. Absence means no such software is inventoried." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope MDaemon installations", "reads": [ "device_hostname", "install_path", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%mdaemon%' OR LOWER(install_path) LIKE '%mdaemon%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts hosting MDaemon. Absence means no such software is inventoried.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "mdaemon-exploit-leads", "type": "query", "label": "MDaemon exploitation traffic", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, url_path, http_method, status_code, src_endpoint_ip, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (LOWER(url_path) LIKE '%worldclient%' OR LOWER(url_path) LIKE '%remoteadmin%') AND http_method = 'POST' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Identify suspicious POST requests to MDaemon web paths.", "expected_signal": "Inbound POST requests to mail server paths from external IPs." }, "parents": [ { "id": "scope-mdaemon-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "MDaemon exploitation traffic", "reads": [ "device_hostname", "http_method", "src_endpoint_ip", "status_code", "time", "url_path" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_path, http_method, status_code, src_endpoint_ip, time FROM hb_http_activity WHERE (('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)) AND (LOWER(url_path) LIKE '%worldclient%' OR LOWER(url_path) LIKE '%remoteadmin%') AND http_method = 'POST' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Inbound POST requests to mail server paths from external IPs.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "phishing-access-leads", "type": "query", "label": "Phishing-related sign-in anomalies", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT LOWER(actor_user_name) AS user, src_endpoint_ip, user_agent, COUNT(DISTINCT device_hostname) as host_count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user, src_endpoint_ip, user_agent HAVING host_count < 3", "surface": "hb_auth_signin", "description": "Find successful sign-ins from rare IPs that may indicate credential compromise.", "expected_signal": "A sign-in from a user account on an IP/User-Agent combination seen on very few hosts." }, "parents": [ { "id": "scope-mdaemon-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Phishing-related sign-in anomalies", "reads": [ "actor_user_name", "device_hostname", "src_endpoint_ip", "status_id", "time", "user_agent" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT LOWER(actor_user_name) AS user, src_endpoint_ip, user_agent, COUNT(DISTINCT device_hostname) as host_count, MIN(time) as first_seen FROM hb_auth_signin WHERE status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY user, src_endpoint_ip, user_agent HAVING host_count < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A sign-in from a user account on an IP/User-Agent combination seen on very few hosts.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "src_endpoint_ip", "user_agent" ], "rare_below": 3 }, "verified_at": "2026-10-29" } }, { "id": "triage-leads", "type": "analytic", "label": "Triage early-stage leads", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "mdaemon-exploit-leads", "phishing-access-leads" ], "objective": "Determine if any host shows evidence of successful mail server exploitation or anomalous authentication suggesting a phished credential was used.", "description": "Summarize whether the initial access evidence suggests a real intrusion.", "max_iterations": 3, "expected_signal": "A per-host verdict on the likelihood of initial access.", "success_criteria": "A verdict of suspicious or malicious for hosts with supporting rows." }, "parents": [ { "id": "mdaemon-exploit-leads", "kind": "merge" }, { "id": "phishing-access-leads", "kind": "merge" } ] }, { "id": "backdoor-execution", "type": "query", "label": "Backdoor process activity", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (instr(',' || '{{backdoor_names}}' || ',', ',' || LOWER(REPLACE(process_name, rtrim(process_name, replace(process_name, '\\', '')), '')) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%rezzuar%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect the execution of backdoor binaries named in the ESET report by matching filenames within the full process path.", "expected_signal": "Processes launching with names associated with HELLAGE, HELLTAG, or Gamaredon tools extracted from full absolute paths." }, "parents": [ { "id": "triage-leads" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Backdoor process activity", "reads": [ "device_hostname", "parent_process_name", "process_cmd_line", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (instr(',' || '{{backdoor_names}}' || ',', ',' || LOWER(REPLACE(process_name, rtrim(process_name, replace(process_name, '\\', '')), '')) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%rezzuar%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Processes launching with names associated with HELLAGE, HELLTAG, or Gamaredon tools extracted from full absolute paths.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "evasion-decoys", "type": "query", "label": "AI guardrail evasion decoys", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, script_name, script_content, time FROM hb_script_activity WHERE (instr(LOWER(script_content), '{{evasion_decoys}}') > 0 OR LOWER(script_content) LIKE '%nuclear weapon%' OR LOWER(script_content) LIKE '%atomic bomb%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify script blocks containing nuclear-themed decoys designed to bypass AI security inspection using the evasion_decoys parameter.", "expected_signal": "Script blocks containing decoy comments about nuclear weapons or atomic bombs as defined in the evasion_decoys list." }, "parents": [ { "id": "triage-leads" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "AI guardrail evasion decoys", "reads": [ "device_hostname", "script_content", "script_name", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_name, script_content, time FROM hb_script_activity WHERE (instr(LOWER(script_content), '{{evasion_decoys}}') > 0 OR LOWER(script_content) LIKE '%nuclear weapon%' OR LOWER(script_content) LIKE '%atomic bomb%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Script blocks containing decoy comments about nuclear weapons or atomic bombs as defined in the evasion_decoys list.", "verified": "dry-run", "verified_at": "2026-10-29" } }, { "id": "final-triage", "type": "analytic", "label": "Analyze full intrusion chain", "config": { "cite": "required", "tools": [ "endpoint", "identity", "web" ], "context": [ "triage-leads", "backdoor-execution", "evasion-decoys" ], "objective": "Determine if any host has transitioned from a suspicious access lead (from triage-leads) to confirmed backdoor execution or AI-evasion behavior.", "description": "Correlate access, execution, and evasion evidence to reach a final verdict.", "max_iterations": 6, "expected_signal": "A comprehensive verdict per host across all phases.", "success_criteria": "A definitive classification of malicious | suspicious | benign per host." }, "parents": [ { "id": "backdoor-execution", "kind": "merge" }, { "id": "evasion-decoys", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on final verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "script-logging-missing", "confidence": "high", "description": "Determine whether to contain a host or move to analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "containment", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Prevent further lateral movement or data theft from the compromised host.", "instructions": "Isolate the host and revoke active cloud sessions for the user accounts identified as suspicious in the auth triage.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Manually verify the AI-evasion decoys and backdoor activity.", "instructions": "Review the script_content and process_cmd_line cited by the agent. Specifically confirm if the 'nuclear weapon' comments were used in proximity to obfuscated code or unauthorized backdoor execution." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "containment" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record the negative result for the estate.", "instructions": "Record the absence of these indicators. If MDaemon servers were identified, confirm they are patched against known CVEs and that no anomalous POST traffic was observed." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" } ] } ] }