Date: 10/14/2026
Severity: High
Summary
This campaign demonstrates how Threat Actors can abuse trusted tools and legitimate Windows components to evade traditional detection. The attack combines LNK execution, Deno-based scripting, DLL side-loading, in-memory execution, and scheduled-task reuse. The final payload targets browser credentials, session cookies, payment data, and Wi-Fi credentials. Behavior-based detection and correlation of multiple attack stages can help identify this activity more effectively than static IOC-based detection.
Indicators of Compromise (IOC) List
Domains/Urls | https://mrmarmok.life/d/09a84bf5afab https://www-go.cfd/d/ffa90e538b6e |
Hash | 1df83ad30dbc235873a4a8382f773e185ae099a3010b503b1e8721e5efd4098a
249c7829d39865570349c036de7087d04b8007165cde2817809fa0a16e030a14
50a3c4f10bcf4b13b2548faf5c52d60ae6c160ea204ae13115152c3957debd8e
7891877acc3b3503ae7561301db40a0b2bc6f31aa3450c11128e0d6797cb51ed
7c4ac9f9a3ef176d478f9411e598c169bc4de2b76315bdffe77158a3eddaa3b6
7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318
c564142dfb209500330c09c39176141f1d13e7e897ee2d8e8715a3dcdf8b324c
d9c629ba6adab0f7b52e645f5d7e07de8b968f743c749042f8fb4ac9b9ab646b
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://www-go.cfd/d/ffa90e538b6e" or url like "https://www-go.cfd/d/ffa90e538b6e" or siteurl like "https://www-go.cfd/d/ffa90e538b6e" or domainname like "https://mrmarmok.life/d/09a84bf5afab" or url like "https://mrmarmok.life/d/09a84bf5afab" or siteurl like "https://mrmarmok.life/d/09a84bf5afab" |
Detection Query 2 : | sha256hash IN ("50a3c4f10bcf4b13b2548faf5c52d60ae6c160ea204ae13115152c3957debd8e","d9c629ba6adab0f7b52e645f5d7e07de8b968f743c749042f8fb4ac9b9ab646b","7f35436153011b4a16761d2dbd3841b5b1f26c2e44f80beca10feb84d4707318","1df83ad30dbc235873a4a8382f773e185ae099a3010b503b1e8721e5efd4098a","c564142dfb209500330c09c39176141f1d13e7e897ee2d8e8715a3dcdf8b324c","7c4ac9f9a3ef176d478f9411e598c169bc4de2b76315bdffe77158a3eddaa3b6","249c7829d39865570349c036de7087d04b8007165cde2817809fa0a16e030a14","7891877acc3b3503ae7561301db40a0b2bc6f31aa3450c11128e0d6797cb51ed")
|
Reference:
Weaponizing Deno