Fox Tempest: AI-Themed Malvertising Delivers Signed Malware at Scale

Threat Hunting IOCs & Queries

The indicators below are a representative subset drawn from the Microsoft reports. Because the operators rotate certificates and infrastructure rapidly, prioritize the behavioral queries that follow over static matching.

Known Indicators of Compromise

• Code-Signing Certificate Thumbprint (SHA-1): 4f5c5b3ef45cfff7721754487a86aeff9a2e6e32
• Command-and-Control Domains: brokeapt[.]com, pan.ssffaa19[.]xyz, pan.rongtv[.]xyz
• Phishing Infrastructure: dash.awaydouble[.]org, servicing.pureplantcravings[.]com
• Redirector Services: grupoconstat[.]bitrix24[.]com[.]br, awstrack[.]me
• Malware-Signing Portal: signspace[.]cloud (Telegram contact @arbadakarba2000)
• Malicious Code Repositories: GitHub repositories "shippingtechnologymovie" and "DeepSeek-V4"
• Associated Malware: Vidar and Lumma (information stealers), Oyster (backdoor); ransomware families signed via the service include Rhysida, INC, Qilin, and BlackByte
• Host Artifacts: pythonw.exe and LICENSE.txt written to %LOCALAPPDATA%; Microsoft Defender detections Trojan:Win32/Vidar, Trojan:Win32/Malgent, Trojan:Win32/Malcert

Fake AI Installer Dropping a Python Downloader

Behavior Targeted: Detects an installer writing a Python downloader (pythonw.exe) and a LICENSE.txt file into the user's local application data folder, a pattern used by the AI-themed installers.
MITRE ATT&CK: T1204.002, T1059.006, T1036.005
Expected Results: Executable installers creating pythonw.exe and LICENSE.txt under AppData\Local, often immediately followed by pythonw.exe network activity.
False Positive Likelihood: MEDIUM. Some legitimate apps bundle Python runtimes.
Tuning Guidance: Allowlist known software that ships an embedded Python runtime and prioritize the co-occurrence of pythonw.exe with LICENSE.txt in the same user-writable path.

Splunk SPL Query

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
    earliest=-30d
    (TargetFilename="*\\AppData\\Local\\*pythonw.exe"
        OR TargetFilename="*\\AppData\\Local\\*LICENSE.txt")
| stats values(TargetFilename) AS files dc(TargetFilename) AS file_variety
    min(_time) AS firstSeen max(_time) AS lastSeen by Computer, User, Image
| where file_variety > 1
| sort - lastSeen

// TUNING: Allowlist apps that legitimately bundle an embedded Python runtime
// FALSE POSITIVES: Developer tooling and packaged Python apps
// TELEMETRY: Requires Sysmon Event ID 11 (file create)

Microsoft KQL Query (Defender/Sentinel)

DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName in~ ("pythonw.exe","LICENSE.txt")
| where FolderPath has "AppData\\Local"
| summarize FileSet=make_set(FileName, 5), Paths=make_set(FolderPath, 10),
    FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName
| where array_length(FileSet) > 1
| order by LastSeen desc

// TUNING: Allowlist software that legitimately ships an embedded Python runtime
// FALSE POSITIVES: Packaged Python applications
// TELEMETRY: Microsoft Defender for Endpoint (DeviceFileEvents)

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Python Downloader Beaconing to External Infrastructure

Behavior Targeted: Detects the Python downloader or a freshly installed binary retrieving a second-stage payload from an external host.
MITRE ATT&CK: T1071.001, T1620
Expected Results: pythonw.exe or recently created installers making outbound web connections to uncommon external hosts shortly after execution.
False Positive Likelihood: MEDIUM. Legitimate Python apps make network calls.
Tuning Guidance: Scope to processes launched from user-writable paths and to first-seen destination domains.

Splunk SPL Query

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    earliest=-30d
    Image="*\\pythonw.exe"
| stats count values(DestinationHostname) AS hosts values(DestinationIp) AS ips
    min(_time) AS firstSeen max(_time) AS lastSeen by Computer, User, Image
| sort - count

// TUNING: Allowlist known internal/SaaS destinations; prioritize first-seen external hosts
// FALSE POSITIVES: Legitimate Python applications with network features
// TELEMETRY: Requires Sysmon Event ID 3 (network connection); enrich with proxy logs

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "pythonw.exe"
| where RemoteUrl !endswith "microsoft.com" and isnotempty(RemoteUrl)
| summarize Count=count(), Hosts=make_set(RemoteUrl, 15),
    FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFolderPath
| order by LastSeen desc

// TUNING: Allowlist sanctioned destinations; weight processes from user-writable folders
// FALSE POSITIVES: Legitimate Python apps with update or telemetry features
// TELEMETRY: Microsoft Defender for Endpoint (DeviceNetworkEvents)

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Connections to Known Malvertising and C2 Infrastructure

Behavior Targeted: Detects endpoint connections to the campaign's command-and-control and redirector domains.
MITRE ATT&CK: T1071.001, T1583.008
Expected Results: Endpoints resolving or connecting to the listed attacker domains.
False Positive Likelihood: LOW for the specific domains.
Tuning Guidance: Treat matches as high fidelity; expand the domain list as new infrastructure is published.

Splunk SPL Query

index=network (sourcetype=pan:traffic OR sourcetype=stream:dns OR sourcetype=zscaler)
    earliest=-30d
    (query="brokeapt.com" OR query="pan.ssffaa19.xyz" OR query="pan.rongtv.xyz"
        OR dest_host="brokeapt.com" OR dest_host="dash.awaydouble.org"
        OR dest_host="servicing.pureplantcravings.com")
| stats count min(_time) AS firstSeen max(_time) AS lastSeen
    by src_ip, query, dest_host
| sort - count

// TUNING: High-fidelity domain match; add new C2 domains as they are reported
// FALSE POSITIVES: Rare; validate any benign lookalike domains
// TELEMETRY: DNS query logs, proxy logs, or firewall traffic logs

Microsoft KQL Query (Defender/Sentinel)

let c2Domains = dynamic(["brokeapt.com","pan.ssffaa19.xyz","pan.rongtv.xyz",
    "dash.awaydouble.org","servicing.pureplantcravings.com"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (c2Domains) or RemoteIPType == "Public" and RemoteUrl in~ (c2Domains)
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, RemoteUrl
| order by LastSeen desc

// TUNING: High-fidelity match; maintain the c2Domains list as new infrastructure is reported
// FALSE POSITIVES: Rare; confirm benign lookalikes
// TELEMETRY: Microsoft Defender for Endpoint (DeviceNetworkEvents)

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Risky Sign-Ins and Token Anomalies After Infection

Behavior Targeted: Detects the account takeover that follows infostealer execution, including impossible travel and anomalous token use.
MITRE ATT&CK: T1557, T1555.003
Expected Results: Elevated-risk sign-ins or token anomalies for users whose endpoints showed stealer activity.
False Positive Likelihood: MEDIUM. Travel and VPN use can raise risk scores.
Tuning Guidance: Correlate risky sign-ins with endpoints that triggered the dropper or C2 queries above to raise fidelity.

Splunk SPL Query

index=azure sourcetype="azure:aad:signin"
    earliest=-30d
    (riskLevelDuringSignIn="high" OR riskLevelDuringSignIn="medium" OR riskState="atRisk")
| stats count values(ipAddress) AS ips values(appDisplayName) AS apps
    min(_time) AS firstSeen max(_time) AS lastSeen by userPrincipalName, riskLevelDuringSignIn
| sort - count

// TUNING: Correlate with endpoints flagged by the dropper/C2 queries to reduce noise
// FALSE POSITIVES: Legitimate travel and VPN egress can elevate risk
// TELEMETRY: Microsoft Entra (Azure AD) sign-in logs

Microsoft KQL Query (Defender/Sentinel)

SigninLogs
| where TimeGenerated > ago(30d)
| where RiskLevelDuringSignIn in ("high","medium") or RiskState == "atRisk"
| summarize Count=count(), IPs=make_set(IPAddress, 10), Apps=make_set(AppDisplayName, 10),
    FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by UserPrincipalName, RiskLevelDuringSignIn
| order by LastSeen desc

// TUNING: Join to DeviceNetworkEvents/DeviceFileEvents hits to confirm endpoint compromise
// FALSE POSITIVES: Legitimate travel and VPN usage
// TELEMETRY: Microsoft Entra (Azure AD) sign-in logs ingested into Sentinel

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.