{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "UAT-6275 is actively targeting regional government and critical infrastructure with custom reverse shells; identifying these intrusions before exfiltration occurs is a high-priority defensive objective." }, "name": "Regional Government and Infrastructure Espionage Activity", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1059.001", "attack.t1133", "attack.t1190", "attack.t1204.002", "attack.t1547.001", "attack.t1071.001", "command and control", "execution", "initial access", "persistence" ], "related": [ { "hunt": "winrar-vulnerability-hygiene", "reason": "General WinRAR patching is a hygiene concern; this hunt specifically looks for the espionage actor's usage.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt correlates vulnerability state with behavioral file and script execution and follow-on persistence. A single rule on scheduled tasks is too noisy; this hunt provides the forensic triage required to link disparate stages into a single intrusion chain.", "coverage": [ { "stage": "appliance-vulnerability-exploitation", "steps": [ "vulnerability-scope" ], "status": "covered" }, { "stage": "document-and-archive-delivery", "steps": [ "file-indicators" ], "status": "covered" }, { "stage": "script-download-and-execution", "steps": [ "github-scripts" ], "status": "covered" }, { "stage": "persistence-via-tasks-and-startup", "steps": [ "rare-tasks" ], "status": "covered" }, { "stage": "reverse-shell-c2", "steps": [ "powershell-c2" ], "status": "covered" } ], "scenario": { "stages": [ { "name": "Edge Appliance Exploitation", "slug": "appliance-vulnerability-exploitation", "tactic": "initial-access", "techniques": [ "T1190", "T1133" ], "observables": [ "CVE-2026-104935", "Ivanti Connect Secure authentication bypass", "SonicWall SMA maximum-severity SSRF", "unintended alternate access path" ] }, { "name": "Malicious Document and Archive Delivery", "slug": "document-and-archive-delivery", "tactic": "execution", "techniques": [ "T1204.002", "T1566.001" ], "observables": [ "macro-enabled documents", "WinRAR vulnerability exploit", "sample.exe", "f_00478d.exe", "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507", "73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f" ] }, { "name": "Script Payload Download and Execution", "slug": "script-download-and-execution", "tactic": "execution", "techniques": [ "T1059.001", "T1105" ], "observables": [ "GitHub-hosted scripts", "PowerShell activity", "payload downloads from public services", "powershell.exe" ] }, { "name": "Persistence via Tasks and Startup Folder", "slug": "persistence-via-tasks-and-startup", "tactic": "persistence", "techniques": [ "T1053.005", "T1547.001" ], "observables": [ "Windows Startup folder changes", "suspicious scheduled tasks", "schtasks.exe" ] }, { "name": "Reverse Shell Command and Control", "slug": "reverse-shell-c2", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1095" ], "observables": [ "custom reverse shells", "lightweight reverse shells" ] } ], "summary": "UAT-6275 is conducting an espionage campaign against government and critical infrastructure in the CIS region using custom reverse shells. The group utilizes diverse initial access vectors including phishing with macro-enabled documents, WinRAR exploits, and the exploitation of vulnerabilities in Ivanti and SonicWall appliances, maintaining persistence through scheduled tasks and the Windows Startup folder." }, "severity": "high", "rationale": "Focus on internet-facing Windows servers and infrastructure in the CIS region first. Expand to workstations if the GitHub-hosted scripts are detected on any beachhead host.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An espionage actor has established a beachhead via edge appliance exploitation or archive delivery, established persistence through scheduled tasks, and is maintaining access via a PowerShell-based reverse shell.", "parameters": { "uat_hashes": { "from": { "ref": "talos-uat-6275-espionage", "kind": "article", "observed": "2026-10-15" }, "type": "list[hash]", "default": [ "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507", "73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f", "58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681", "fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f" ], "description": "Malware hashes associated with UAT-6275 payloads." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to narrow the behavioral queries." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "uat_filenames": { "from": { "ref": "talos-uat-6275-espionage", "kind": "article", "observed": "2026-10-15" }, "type": "list[string]", "default": [ "sample.exe", "f_00478d.exe", "kmsauto net.exe" ], "description": "Filenames reported in UAT-6275 activity." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/", "name": "Talos \u2014 The Q3 Vulnerability Pulse: Discovery \u2260 Exploitation" } ], "blind_spots": [ { "id": "appliance-visibility-gap", "risk": "Compromise of the appliance that does not immediately result in follow-on activity on a monitored endpoint will be missed.", "stage": "appliance-vulnerability-exploitation", "question": "whether the initial bypass was executed on the appliance", "requires": "EDR agent on the appliance itself" }, { "id": "encrypted-reverse-shell", "risk": "A custom shell using TLS on port 443 might be mistaken for normal web traffic without content inspection.", "stage": "reverse-shell-c2", "question": "whether the outbound traffic on common ports contains reverse shell commands", "requires": "TLS decryption / PCAP" } ] }, "name": "Regional Government and Infrastructure Espionage Activity", "description": "This hunt follows the tradecraft of UAT-6275, an actor targeting government and critical infrastructure for diplomatic and economic intelligence. The hunt identifies vulnerable edge appliances such as Ivanti or SonicWall, then parallels searches for malicious file drops and GitHub-hosted script execution. Following an initial triage, it shifts to finding follow-on persistence in the task scheduler and outbound reverse-shell traffic, correlating these disparate stages into a high-confidence intrusion verdict." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "coverage": [ { "stage": "appliance-vulnerability-exploitation", "steps": [ "vulnerability-scope" ], "status": "covered" }, { "stage": "document-and-archive-delivery", "steps": [ "file-indicators" ], "status": "covered" }, { "stage": "script-download-and-execution", "steps": [ "github-scripts" ], "status": "covered" }, { "stage": "persistence-via-tasks-and-startup", "steps": [ "rare-tasks" ], "status": "covered" }, { "stage": "reverse-shell-c2", "steps": [ "powershell-c2" ], "status": "covered" } ], "rationale": "An espionage actor has established a beachhead via edge appliance exploitation or archive delivery, established persistence through scheduled tasks, and is maintaining access via a PowerShell-based reverse shell.", "blind_spots": [ { "id": "appliance-visibility-gap", "risk": "Compromise of the appliance that does not immediately result in follow-on activity on a monitored endpoint will be missed.", "stage": "appliance-vulnerability-exploitation", "question": "whether the initial bypass was executed on the appliance", "requires": "EDR agent on the appliance itself" }, { "id": "encrypted-reverse-shell", "risk": "A custom shell using TLS on port 443 might be mistaken for normal web traffic without content inspection.", "stage": "reverse-shell-c2", "question": "whether the outbound traffic on common ports contains reverse shell commands", "requires": "TLS decryption / PCAP" } ], "scoping_notes": "Focus on internet-facing Windows servers and infrastructure in the CIS region first. Expand to workstations if the GitHub-hosted scripts are detected on any beachhead host.", "beyond_detection": "This hunt correlates vulnerability state with behavioral file and script execution and follow-on persistence. A single rule on scheduled tasks is too noisy; this hunt provides the forensic triage required to link disparate stages into a single intrusion chain." } }, { "id": "vulnerability-scope", "type": "query", "label": "Hosts with appliance vulnerabilities", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid, title, severity, first_seen FROM hb_vulnerability_finding WHERE (cve_uid = 'CVE-2026-104935' OR LOWER(title) LIKE '%ivanti%' OR LOWER(title) LIKE '%sonicwall%')", "surface": "hb_vulnerability_finding", "description": "Scope the hunt to hosts where the environment has found appliance-based vulnerabilities like the Ivanti bypass or SonicWall SSRF.", "expected_signal": "A list of device UIDs affected by edge appliance vulnerabilities. Silence means no appliances in scope are flagged as vulnerable to these specific CVEs." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Hosts with appliance vulnerabilities", "reads": [ "device_uid", "cve_uid", "title", "severity", "first_seen" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid, title, severity, first_seen FROM hb_vulnerability_finding WHERE (cve_uid = 'CVE-2026-104935' OR LOWER(title) LIKE '%ivanti%' OR LOWER(title) LIKE '%sonicwall%')", "silence": "not_evidence_of_absence", "expected": "A list of device UIDs affected by edge appliance vulnerabilities. Silence means no appliances in scope are flagged as vulnerable to these specific CVEs.", "verified": "dry-run", "verified_at": "2026-10-16" } }, { "id": "file-indicators", "type": "query", "label": "Search for malicious file indicators", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_hash_sha256, process_name, time FROM hb_file_activity WHERE (instr(',' || '{{uat_hashes}}' || ',', ',' || file_hash_sha256 || ',') > 0 OR LOWER(process_name) LIKE '%\\\\winrar.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Search for specific hashes and rare files dropped by suspicious parent processes like WinRAR.", "expected_signal": "Any row showing known malicious hashes or files dropped by archive utilities. Silence means no suspicious drops were observed." }, "parents": [ { "id": "vulnerability-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Search for malicious file indicators", "reads": [ "device_hostname", "file_name", "file_path", "file_hash_sha256", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_hash_sha256, process_name, time FROM hb_file_activity WHERE (instr(',' || '{{uat_hashes}}' || ',', ',' || file_hash_sha256 || ',') > 0 OR LOWER(process_name) LIKE '%\\\\winrar.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any row showing known malicious hashes or files dropped by archive utilities. Silence means no suspicious drops were observed.", "verified": "dry-run", "verified_at": "2026-10-16" } }, { "id": "github-scripts", "type": "query", "label": "PowerShell scripts from GitHub", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, script_content, script_type, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%github%' AND (LOWER(script_content) LIKE '%iex%' OR LOWER(script_content) LIKE '%invoke-expression%' OR LOWER(script_content) LIKE '%downloadstring%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify PowerShell execution that pulls payloads from GitHub, a common UAT-6275 delivery method.", "expected_signal": "PowerShell script blocks containing GitHub URLs and execution keywords, indicating external payload retrieval." }, "parents": [ { "id": "vulnerability-scope" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "PowerShell scripts from GitHub", "reads": [ "device_hostname", "script_content", "script_type", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, script_type, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%github%' AND (LOWER(script_content) LIKE '%iex%' OR LOWER(script_content) LIKE '%invoke-expression%' OR LOWER(script_content) LIKE '%downloadstring%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "PowerShell script blocks containing GitHub URLs and execution keywords, indicating external payload retrieval.", "verified": "dry-run", "verified_at": "2026-10-16" } }, { "id": "early-triage", "type": "analytic", "label": "Assess early infection likelihood", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "vulnerability-scope", "file-indicators", "github-scripts" ], "objective": "Determine if any host in scope shows evidence of being successfully compromised by UAT-6275 based on the vulnerability findings and execution markers.", "description": "Evaluate whether the scoped vulnerability and initial signals suggest a successful beachhead.", "max_iterations": 3, "expected_signal": "A per-host verdict on whether infection material is present.", "success_criteria": "A per-host verdict citing specific vulnerability findings or script content." }, "parents": [ { "id": "file-indicators", "kind": "merge" }, { "id": "github-scripts", "kind": "merge" } ] }, { "id": "rare-tasks", "type": "query", "label": "Rare scheduled tasks", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT job_name, job_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_cmd_line HAVING hosts <= 2", "surface": "hb_scheduled_job", "description": "Stack-count scheduled jobs to find rare persistence entries created by the actor.", "expected_signal": "Scheduled tasks with rare command lines that appear on only one or two hosts. Silence means no rare tasks were identified." }, "parents": [ { "id": "early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare scheduled tasks", "reads": [ "job_name", "job_cmd_line", "device_hostname", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT job_name, job_cmd_line, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY job_cmd_line HAVING hosts <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Scheduled tasks with rare command lines that appear on only one or two hosts. Silence means no rare tasks were identified.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "job_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-10-16" } }, { "id": "powershell-c2", "type": "query", "label": "PowerShell reverse-shell connections", "config": { "dsl": "sqlite", "role": "triage", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE (LOWER(process_name) LIKE '%\\\\powershell.exe' OR instr(',' || '{{uat_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Monitor for outbound TCP connections from PowerShell or known binaries to detect reverse-shell activity.", "expected_signal": "Outbound connections from PowerShell or suspect binaries. Silence means no outbound traffic matching these patterns was found." }, "parents": [ { "id": "early-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "PowerShell reverse-shell connections", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE (LOWER(process_name) LIKE '%\\\\powershell.exe' OR instr(',' || '{{uat_filenames}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outbound connections from PowerShell or suspect binaries. Silence means no outbound traffic matching these patterns was found.", "verified": "dry-run", "verified_at": "2026-10-16" } }, { "id": "final-triage", "type": "analytic", "label": "Intrusion assessment", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "early-triage", "rare-tasks", "powershell-c2" ], "objective": "Determine if any host showing early-stage signals also displays persistence (rare tasks) or C2 (outbound PowerShell), confirming the UAT-6275 espionage chain.", "description": "Correlate early stage triage with persistence and network signals to confirm a full espionage chain.", "max_iterations": 6, "expected_signal": "A high-confidence verdict on whether a full intrusion occurred.", "success_criteria": "A final verdict of malicious | suspicious | benign per host." }, "parents": [ { "id": "rare-tasks", "kind": "merge" }, { "id": "powershell-c2", "kind": "merge" } ] }, { "id": "route-assessment", "type": "checkpoint", "label": "Route on assessment", "config": { "fuzzy": true, "judge": "hunter", "question": "the final triage verdict is malicious for at least one host", "condition": "the final triage verdict is malicious for at least one host", "blind_spot": "appliance-visibility-gap", "confidence": "high", "description": "Direct the hunt based on the intrusion verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further exfiltration by isolating infected hosts.", "instructions": "Isolate the host using the endpoint agent. Collect the identified payloads for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "route-assessment", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Provide manual oversight for suspicious hits and confirm the agent's logic.", "instructions": "Examine the cited rows for the PowerShell scripts and rare tasks. Verify the destination IPs for reverse-shell traffic. Escalate if persistence is confirmed." }, "parents": [ { "id": "route-assessment", "branch": "default" }, { "id": "route-assessment", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and ensure all examined hosts are accounted for.", "instructions": "Record the results. If no activity was found, verify if any new GitHub repositories have been identified for UAT-6275 and update the parameters for the next run." }, "parents": [ { "id": "route-assessment", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }