A newly tracked threat cluster known as GhostShell is targeting Ukraine’s UAV and broader drone ecosystem. The operation uses advanced malware, including mTLS-authenticated implants and memory-resident loaders. To gain initial access, the attackers rely on decoy documents that impersonate a Ukrainian drone company.
The analyst uncovered a multi-stage intrusion chain built around VBS scripts, mTLS-enabled implants such as 122.exe , and Telegram-based loaders including update.exe . Reverse engineering exposed custom XOR decryption logic, an embedded private PKI, and use of Xray Core for covert tunneling. The investigation also identified Vidar infostealer activity within the same infrastructure.
Organizations should enforce strict mTLS certificate validation and monitor for unauthorized use of client certificates. Endpoint visibility should be improved to detect in-memory loading, ntdll.dll unhooking, and suspicious changes to Windows Run key persistence. Teams should also watch for abnormal outbound traffic to known command-and-control domains and Telegram-driven configuration retrieval.
Affected systems should be isolated immediately, followed by memory forensics to identify any in-memory implants. Network logs should be reviewed for traffic involving cloudaxis.cc and cdnexpress.cc . Security teams should also hunt for the referenced SHA-256 hashes and monitor for the specific mTLS client certificate CN=ed6e62814295701f .
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary has gained an initial foothold and is attempting to pull down a specialized payload ( 122.exe ) to solidify control over the target. To maintain a low profile, the malware uses a hijacked or seemingly legitimate-looking CDN domain ( cloudaxis.cc ). Following the download, the malware attempts to “heartbeat” or send telemetry back to the C2 infrastructure via a specific analytics endpoint ( cdnexpress.cc/analytics ). The simulation will use curl to mimic these specific GET requests to trigger the URI-based detection logic.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
