Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
BlueNoroff, a North Korean state-sponsored threat group, is using an advanced phishing kit that impersonates Zoom and Microsoft Teams meetings. The campaign abuses compromised Telegram accounts belonging to trusted contacts to deliver a ClickFix payload through social engineering. The attack chain also performs browser-based cryptocurrency wallet reconnaissance and delivers malware targeting both Windows and macOS systems.
Investigation
JUMPSEC analyzed exposed JavaScript source maps to reconstruct the complete attack chain and uncover the supporting infrastructure. The investigation identified a self-propagating mechanism in which successfully compromised victims can become new infection vectors through Telegram. Analysts also linked the C2 infrastructure to Cloudzy/RouterHosting LLC and identified malware variants including Trojan.NukeSped.
Mitigation
Organizations should require out-of-band verification for meeting invitations received through messaging platforms such as Telegram. Security teams should monitor for suspicious PowerShell and VBScript execution, as well as unusual macOS Keychain access through the security CLI. Blocking or closely monitoring connections to known bulletproof hosting providers such as Cloudzy can further reduce exposure.
Response
If malicious activity is detected, affected Windows and macOS endpoints should be isolated immediately to limit further movement and data exfiltration. Active Telegram sessions should be revoked, and high-privilege accounts should be reviewed for signs of compromise. Organizations should also coordinate with cryptocurrency exchanges and Web3 service providers when wallet reconnaissance indicators are discovered.
Attack Flow
Detections
Suspicious Command and Control by Unusual Top Level Domain (TLD) DNS Request (via dns)
View
Download or Upload via Powershell (via cmdline)
View
LOLBAS WScript / CScript (via process_creation)
View
Suspicious CURL Usage (via cmdline)
View
Suspicious Powershell Strings (via powershell)
View
Windows Defender Preferences Suspicious Changes (via powershell)
View
Possible Telegram Abuse As Command And Control Channel (via dns_query)
View
Possible MacOS System Enumeration Using Sysctl Utility (via cmdline)
View
Possible MacOS Browser Password Discovery Attempt (via cmdline)
View
Suspicious Curl Execution Attempt [MacOS] (via cmdline)
View
IOCs (HashSha256) to detect: Inside a DPRK BlueNoroff ClickFix Kit
View
IOCs (SourceIP) to detect: Inside a DPRK BlueNoroff ClickFix Kit
View
IOCs (DestinationIP) to detect: Inside a DPRK BlueNoroff ClickFix Kit
View
Detection of XAMPP Default Page Indicative of Compromised Server [Webserver]
View
Detect Windows Defender Bypass via PowerShell Exclusion [Windows File Event]
View
IEX Payload Execution via PowerShell for Spearphishing [Windows Powershell]
View
## Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands: The adversary is performing automated reconnaissance to identify “low-hanging fruit” web servers. Using a lightweight scanner, the attacker probes for the presence of the XAMPP dashboard, which is often left exposed in development environments. Finding this indicator allows the attacker to confirm the environment’s architecture and prepare for more targeted exploits, such as exploiting known vulnerabilities in outdated XAMPP components. The simulation will manually trigger the rule by requesting the
/dashboard/path and simulating a response body that contains the string ‘XAMPP’. -
Regression Test Script:
#!/bin/bash # Simulation script to trigger the XAMPP detection rule echo "[+] Starting XAMPP Detection Simulation..." # Simulation 1: Trigger via URL path (/dashboard/) echo "[+] Simulating request to /dashboard/..." curl -s -o /dev/null -w "%{http_code}" http://localhost/dashboard/ echo -e "n[+] Request sent." # Simulation 2: Trigger via Response Body (Simulating a page containing 'XAMPP') # Note: In a real scenario, the web server would return this. # For the sake of testing the SIEM ingestion of the string, we ensure # the log entry itself contains the pattern if the rule parses body content. echo "[+] Simulating response body content containing 'XAMPP'..." # We use a dummy log injection if we are testing the ingestion pipeline, # but ideally, we serve a file via Apache that contains the string. echo "<html><body>Welcome to XAMPP Server</body></html>" > /var/www/html/test_xampp.html curl -s http://localhost/test_xampp.html > /dev/null echo "[+] Request for content-based detection sent." echo "[+] Simulation Complete. Check SIEM for alerts." -
Cleanup Commands:
#!/bin/bash # Cleanup script to remove simulation artifacts echo "[+] Cleaning up simulation artifacts..." sudo rm -f /var/www/html/test_xampp.html echo "[+] Cleanup complete."
