PhantomEnigma — hijacked Brazilian .gov.br portals delivering an Electron/Node.js backdoor

ANY.RUN researchers documented PhantomEnigma, a Brazil-focused crimeware operation active since at least January 2026 (231 sandbox detonations tracked through July 2026, peaking in March and May) that has hijacked at least 20 .gov.br municipal and police web portals and gained access to legitimate government mailboxes, using both as trusted delivery infrastructure against banking and public-sector targets. The campaign evolved from a 2025 banking-focused browser-extension banker into a 2026 modular backdoor delivered through abused government trust.

The lure is a fake police notice ("Ofício Polícia Civil") or a digital power-of-attorney document ("Procuração Digital"), sometimes carrying a QR code, sent from a genuinely compromised government mailbox — so the message legitimately passes SPF, DKIM and DMARC. Clicking through routes the victim via a compromised .gov.br host or a lookalike domain to a Delphi-compiled Inno Setup installer (Procuracao_Digital.exe) that silently deploys a patched Electron application — observed as a modified Boostnote build (decoy binaries App.exe / renamed Grape.exe) — hiding an obfuscated index.js Node.js backdoor inside an install directory following the pattern UltraSuiteSmartCoreware / SmartSuiteSmartCoreware / ProSoftxUltraToolator under a transient is-*.tmp\<Name>Application\ folder.

The backdoor persists via Registry Run Keys, fingerprints the host, executes attacker JavaScript through eval(), and beacons to rotating C2 roughly every 180 seconds. ANY.RUN identified two beacon generations: an older GET /laravel.php?api=api&hash=<b64>&message=<b64> pattern and a newer POST /nbw/ pattern carrying JSON with machine ID, COMPUTERNAME, USERNAME and a campaign tag. A related "Ofício-PC" phishing arm delivers the same fake police documents from compromised government hosts before pivoting to a Shellter-packed Cobalt Strike loader via what the source calls the "Zab agent" kit.

ANY.RUN's own detection guidance is the pack's organizing principle: C2 domains and IPs rotate near-weekly and are already perishable, but the Delphi + Inno Setup + Node.js/Electron build chain, the install-directory naming pattern, and the beacon URI shapes are structural and durable. Hunt and detect on the build chain and install-directory pattern first; treat the domain/IP list as a fast-expiring supplement, not the primary control.

Defender priority: ten queries follow. Q1, Q2 and Q4 (lure installer execution, patched-Electron decoy in a campaign install directory, and Registry Run persistence pointing at that directory) are the highest-confidence, lowest-noise detections and catch this actor at deployment, before any beacon traffic exists. Run those three first.

Research decisions

• Single-source atomic indicators, cross-verified with an independent fetch pass. Every hash, IP, domain and install-directory pattern in this pack comes from ANY.RUN. To reduce single-source risk, the ANY.RUN page was fetched twice by two different methods (a summarizing fetch and an independent reader-proxy extraction); both passes returned the same values, including the exact partial Shellter-loader hash prefix supplied in the task brief, which the reader-proxy reproduced without being given that value first — strong evidence the extraction reflects genuine page content rather than pattern-completion.
• HackRead dropped, not fabricated around. The HackRead URL in the task brief could not be retrieved by direct fetch, cache, or reader-proxy (bot-wall/CAPTCHA in all three cases). No content was ever returned from it, so nothing from it was used, and it is not cited as a source below. This is a straightforward access failure, not a content or safety issue — no injected instructions were observed because no content was ever served.
• No prompt-injection or manipulated content was found in any of the five sources that did return content. All read as ordinary security journalism/research; none contained instructions directed at an AI agent.
• Compromised .gov.br hostnames are victim infrastructure, not detection targets. The Hacker News lists specific compromised government hosts (timon.ma.gov.br, loginam.sesp.es.gov.br, aplicacao.cbm.mt.gov.br, prodoc.ap.gov.br). These are recorded as attack-chain context in section 3 only. They are not shipped as block/detect indicators anywhere in this pack — they are real Brazilian government systems, and blocking them would be pointless for any organization outside Brazil and harmful if applied indiscriminately.
• Shellter-loader hash is partial by design of the source, not by omission here. The task brief and both ANY.RUN fetch passes converge on the same truncated value, 7de52b73…296e1f64. The missing middle digits are not published anywhere found. This value is carried as a named, flagged partial indicator in section 4 — never treated as a complete SHA256 and never placed in an exact-match CQL query or the Falcon IOC CSV, where a truncated hash would either fail to match or silently match nothing.
• Categorization discrepancy on 91.92.241.181, noted not resolved. The task brief lists this IP as a beacon IP alongside 185.219.83.191 and 188.137.246.189. The reader-proxy pass of the ANY.RUN source groups it instead with the 158.94.208.120 origin node under AS202412 OMEGATECH-AS. Both framings appear in ANY.RUN-derived reporting and the IP value itself is consistently attributed to the campaign either way — this pack ships it as a detect-worthy network indicator regardless of which infrastructure role it plays, and flags the categorization ambiguity here rather than silently picking one.
• Perishability. ANY.RUN states C2 domains and IPs rotate on a near-weekly basis. Network indicators in section 4 are marked with a 30-day expiry, materially shorter than the build-chain/install-directory behavioral signals, which the source explicitly frames as the durable detection surface and which carry no expiry.
• Two additional C2 domains found during verification. The reader-proxy pass of ANY.RUN surfaced pccvill[.]com and taaeiuep[.]com alongside the five domains in the task brief. These are included in the IOC table as source-confirmed but lower-priority (they were not in the original task list and appear only in the supplementary extraction pass), not fabricated additions.

Attack chain

Hunt hypotheses, ordered by fidelity

All values below trace to the ANY.RUN source snapshot (PhantomEnigma-Hunt-sources/01-anyrun-research.txt), independently corroborated by a second reader-proxy fetch pass and, for the zsxocjarsate[.]com domain and the /nbw/ beacon path, by Cybersecurity News. Domains are shown defanged. Compromised .gov.br victim hostnames are intentionally excluded from this table — see section 2.

Run these where Falcon coverage is thin, on hosts with agent gaps, or as a second opinion on a host the CQL flagged. They need no EDR.

Sweep for the campaign install-directory pattern and dropped files

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Directory |
  Where-Object { $_.FullName -match 'UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator' } |
  Select-Object FullName, CreationTime, LastWriteTime

Get-ChildItem -Path C:\Users\*\AppData\Local\Temp -Recurse -ErrorAction SilentlyContinue -Filter 'is-*.tmp' -Directory |
  ForEach-Object {
    Get-ChildItem -Path $_.FullName -Recurse -Filter 'index.js' -ErrorAction SilentlyContinue |
      Select-Object FullName, Length, LastWriteTime,
        @{ n='SHA256'; e={ (Get-FileHash $_.FullName -Algorithm SHA256).Hash } }
  }

Check Run/RunOnce keys for the campaign install-directory pattern

$paths = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
         'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    Get-Member -MemberType NoteProperty |
    Where-Object { $_.Name -notmatch '^PS' } |
    ForEach-Object {
      $val = (Get-ItemProperty -Path $p).($_.Name)
      if ($val -match 'UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator') {
        [pscustomobject]@{ Key = $p; Name = $_.Name; Value = $val }
      }
    }
}

Check for the installer and backdoor hashes anywhere on disk

$targets = @{
  'e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0' = 'Procuracao_Digital.exe installer'
  '71f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c' = 'index.js backdoor'
}
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Include *.exe,*.js |
  ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($h -and $targets.ContainsKey($h)) {
      [pscustomobject]@{ File = $_.FullName; SHA256 = $h; Match = $targets[$h] }
    }
  }

No query carries an in-query time filter. Set the window with the console time picker. Each card records the intended lookback as a // LOOKBACK: comment.

// HUNT: PhantomEnigma lure installer executed (Procuracao_Digital / Ofício-PC arm)
// MITRE: T1566.002, T1204.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// LOOKBACK: 30d
// FALSE POSITIVES: none known -- these are campaign-specific lure filenames
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(Procuracao_Digital|oficio\d{1,8}PCAP)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Patched Electron/Boostnote decoy running from campaign install directory
// MITRE: T1036, T1204.002 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// LOOKBACK: 30d
// FALSE POSITIVES: none known -- genuine Boostnote/Electron installs do not use these path names
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(App|Boost ?Note|Grape)(\.exe)?$/i
| ImageFileName=/\\(UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator|is-[a-z0-9]{4,8}\.tmp)\\/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Decoy Electron PE binary written under Inno Setup is-*.tmp staging directory
// MITRE: T1027, T1036 | CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten
// LOOKBACK: 30d
// FALSE POSITIVES: none known
// GAP: index.js itself is not independently visible -- no Falcon event covers generic non-PE file writes
#event_simpleName=/^PeFileWritten$/
| TargetFileName=/\\(UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator|is-[a-z0-9]{4,8}\.tmp)\\.*(App|Boost ?Note|Grape)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

// HUNT: Run/RunOnce key set to an executable inside the campaign install-directory pattern
// MITRE: T1547.001 | CONF: high  FP: low  COST: low
// REQUIRES: RegGenericValueUpdate or AsepValueUpdate (registry value telemetry must be on)
// LOOKBACK: 30d
// FALSE POSITIVES: none known
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName=/\\(Run|RunOnce)$/i
| RegStringValue=/\\(UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator)\\/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=200)

// HUNT: High-frequency outbound connections consistent with ~180s beacon cadence
// MITRE: T1071.001, T1071 | CONF: medium  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4
// LOOKBACK: 24h (short window keeps the cadence calculation meaningful)
// FALSE POSITIVES: telemetry/licensing/update-check agents that poll on a fixed interval
// TUNING: exclude known-good polling agents by ContextBaseFileName (your EDR, MDM,
// TUNING: patch-management and telemetry agents) before triaging what remains.
#event_simpleName=/^NetworkConnectIP4$/
| groupBy([aid, ComputerName, RemoteAddressIP4], function=[count(as=ConnCount), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| ConnCount >= 15
| DurationSec := (LastSeen - FirstSeen) / 1000
| AvgIntervalSec := DurationSec / ConnCount
| AvgIntervalSec > 150 and AvgIntervalSec < 210
| sort(ConnCount, order=desc, limit=200)

// HUNT: PhantomEnigma C2 domain resolution
// MITRE: T1071.001, T1090 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// LOOKBACK: 30d (infrastructure rotates near-weekly per source -- do not extend much further)
// FALSE POSITIVES: security-vendor scanners and sinkhole research hosts
#event_simpleName=/^DnsRequest$/
| in(DomainName, values=["zsxocjarsate.com", "psznaoehteeh.com", "eeresofeuae.com", "dahieenloo.com", "policiacivilmg.com", "pccvill.com", "taaeiuep.com"])
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Connections to published PhantomEnigma beacon/origin IPs
// MITRE: T1071.001, T1090 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// LOOKBACK: 30d
// FALSE POSITIVES: shared VPS ranges can host unrelated services after reassignment
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=["185.219.83.191", "188.137.246.189", "91.92.241.181", "158.94.208.120"])
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, LocalAddressIP4])
| sort(@timestamp, order=desc, limit=500)

// HUNT: PhantomEnigma HTTP beacon URI pattern (GET /laravel.php or POST /nbw/)
// MITRE: T1071.001 | CONF: medium  FP: low  COST: low
// REQUIRES: Web-proxy / secure-web-gateway HTTP logs ingested into Next-Gen SIEM.
// REQUIRES: NOT available from native Falcon sensor telemetry (no URI-path field).
// LOOKBACK: 30d
// FALSE POSITIVES: low if both the path and method match, but field names below are
// FALSE POSITIVES: generic placeholders -- confirm against your proxy log's actual schema.
// ⚠ Field unverified -- validate url / http_method against your tenant's log source before deploying.
#event_simpleName=/^(HttpRequestEvent|ProxyEvent)$/
| (http_method=/^GET$/i and url=/\/laravel\.php\?api=api&hash=/i) or (http_method=/^POST$/i and url=/\/nbw\/?$/i)
| table([@timestamp, aid, ComputerName, http_method, url, RemoteAddressIP4])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Published PhantomEnigma installer and backdoor hashes
// MITRE: T1105, T1204.002 | CONF: high  FP: low  COST: medium
// REQUIRES: ProcessRollup2, PeFileWritten
// LOOKBACK: 60d
// FALSE POSITIVES: none. Only two complete, published hashes are used -- the partial
// FALSE POSITIVES: Shellter-loader hash is intentionally excluded (see section 4).
// GAP: the index.js hash is not guaranteed to appear -- no Falcon event covers generic non-PE file writes
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| in(SHA256HashData, values=["e0dae1a04b7a3b2ae07377b0fd00681e9633532788870b3709a9e149f3ccf0e0", "71f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c"])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Campaign decoy spawning a shell, or the Ofício-PC Shellter-loader naming pattern
// MITRE: T1059.007, T1059.001, T1027 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// LOOKBACK: 14d
// FALSE POSITIVES: legitimate Electron apps that spawn helper processes
// TUNING: for the shell-spawn branch, exclude known-good Electron apps by ParentBaseFileName
// TUNING: once you have confirmed which ones legitimately run in your estate. The loader-name
// TUNING: branch has no exclusion list yet -- the hash is unverified, so treat every hit as
// TUNING: needing manual review, not auto-triage.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(cmd|powershell|pwsh)\.exe$/i and ParentBaseFileName=/^(App|Boost ?Note|Grape)(\.exe)?$/i and ImageFileName=/\\(UltraSuiteSmartCoreware|SmartSuiteSmartCoreware|ProSoftxUltraToolator)\\/i) or (FileName=/^oficio\d{1,8}PCAP\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=200)

Four queries are tight enough to promote to real-time detection. The rest stay Investigate-only hunts until tuned or until proxy/HTTP telemetry is confirmed available.

Scheduled Search: lure installer or decoy-in-campaign-path execution

Alert email

Subject: [CRITICAL] Detection: PhantomEnigma — lure installer or backdoor decoy executed

WHAT FIRED
  A process matching the published PhantomEnigma lure installer or patched-Electron
  decoy pattern ran on HOST-01 as user jdoe.

  Process : {{FileName}}
  Path    : {{ImageFileName}}
  Host    : {{ComputerName}} ({{aid}})
  User    : {{UserName}}
  SHA256  : {{SHA256HashData}}
  Time    : {{@timestamp}}

WHY IT MATTERS
  ANY.RUN documented this build chain (Delphi-compiled Inno Setup installer, patched
  Electron/Boostnote decoy, obfuscated index.js backdoor) as PhantomEnigma -- a Brazil-
  focused campaign that hijacked 20+ .gov.br government portals and compromised
  government mailboxes to deliver this payload against banking and public-sector
  targets. A hit means a user ran the lure installer or the decoy app is now present
  on this host. The backdoor persists via a Registry Run Key and beacons to rotating
  C2 roughly every 180 seconds -- containment before the first beacon matters.

IMMEDIATE ACTIONS
  1. Network-contain the host in Falcon.
  2. Check for a Registry Run Key pointing into the campaign install-directory pattern
     (Q4) -- if present, persistence is already established.
  3. Run Q3 scoped to this host to confirm the index.js backdoor is on disk.
  4. Run Q6, Q7 and Q5 (beacon-cadence hunt) scoped to this host to determine whether
     C2 contact has already occurred.
  5. Preserve the installer, the decoy binary, and the index.js file for analysis.
  6. If this is a banking or financial-services environment, treat any credentials
     entered on this host in the last 24 hours as potentially exposed.

ESCALATION
  Page IR on-call. This is an active, evolving campaign per the 2026-08-17 weekly
  threat recap -- do not assume commodity/low-priority handling.

L1 triage checklist

1. Confirm the filename and path against the published lure-installer and decoy patterns in section 4. A near-miss on the install-directory string is still worth escalating.
2. Pull the file's SHA256 and compare against Q9. A miss does not clear it -- ANY.RUN notes the build chain is more durable than any single sample hash.
3. Run Q4 scoped to this host to confirm or rule out Registry Run Key persistence.
4. Run Q3 scoped to this host to look for the dropped index.js.
5. Run Q6 and Q7 scoped to this host, then estate-wide, to check for beacon contact.
6. Run Q5 scoped to this host for the ~180-second beacon-cadence signal, which can catch contact with infrastructure not yet on the known-IOC list.
7. Identify how the installer arrived -- check mail logs for an "Ofício" or "Procuração Digital" themed message from a .gov.br sender in the prior 24 hours.
8. If web-proxy/HTTP logs are available, run Q8 to check for the /laravel.php or /nbw/ beacon shapes.

Pivot queries

Host-scoped: append | aid = "<the aid from the alert>" to Q3, Q4, Q5, Q6, Q7 and Q10. Environment-wide: run Q1, Q2, Q6, Q7 and Q9 unscoped across the longest retention window you have -- the campaign's own detonation data shows repeated waves against the same sectors, so one hit is reason to sweep broadly.

Investigate-only: Q5, Q8 and Q10 are hunt queries, not alert candidates as shipped. Q5 needs an environment-specific polling-agent exclusion list, Q8 needs your proxy log schema validated first, and Q10's loader-name branch has an unverified hash. Their value is in a weekly review or as an enrichment pivot from a Q1/Q2/Q4/Q9 hit, not a standalone real-time page.

Playbook 1 — Deny silent secondary-installer deployment from user-writable directories (AppLocker)

# Prerequisites: AppLocker already deployed in Audit mode with a working default rule set;
#                Application Identity service (AppIDSvc) set to Automatic and running;
#                a pilot ring of 20 to 50 representative endpoints. Confirm your legitimate
#                software-deployment tooling (SCCM, Intune, RMM) does not stage installers
#                under Users\<user>\AppData\Local\Temp before enforcing.
# Reboot required: no. Policy applies at the next Group Policy refresh; AppIDSvc must be running.
# Rollback: re-import the policy saved in step 1 --
#           Set-AppLockerPolicy -XmlPolicy C:\Backup\AppLocker-pre-change.xml -Merge:$false
#           then gpupdate /force. Removing the deny rule from the GPO has the same effect.

# 1. Save the current effective policy first. Do not skip this -- it is the rollback.
New-Item -ItemType Directory -Path C:\Backup -Force | Out-Null
Get-AppLockerPolicy -Effective -Xml | Out-File C:\Backup\AppLocker-pre-change.xml -Encoding utf8

# 2. Confirm the enforcement service is running, or the policy is inert.
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# 3. Add a DENY rule for the campaign install-directory naming pattern specifically --
#    this is narrower and safer to enforce immediately than a blanket Temp-directory deny.
#    Author as a Path rule in the GPO editor under
#    Computer Configuration > Policies > Windows Settings > Security Settings >
#    Application Control Policies > AppLocker, Executable Rules:
#
#      DENY  Everyone  %OSDRIVE%\ProgramData\UltraSuiteSmartCoreware\*
#      DENY  Everyone  %OSDRIVE%\ProgramData\SmartSuiteSmartCoreware\*
#      DENY  Everyone  %OSDRIVE%\ProgramData\ProSoftxUltraToolator\*
#
#    Broader Temp-directory silent-installer denial is a near-term, not immediate,
#    control -- pilot it separately after confirming your deployment tooling is unaffected.

# 4. Verify the rules are live on a pilot host.
Get-AppLockerPolicy -Effective |
  Select-Object -ExpandProperty RuleCollections |
  ForEach-Object { $_ } |
  Where-Object { $_.Action -eq 'Deny' } |
  Select-Object RuleCollectionType, Name, Action

# 5. Post-deployment CQL spot-check: Q2 should return nothing new from these paths.

Playbook 2 — Enable the "block executable content from email/webmail" ASR rule

# Prerequisites: Microsoft Defender Antivirus active (not passive alongside another AV).
#                Run in Audit (2) for one week and review Defender/Operational event 1121
#                before enforcing, since some legitimate workflows email installers directly.
# Reboot required: no.
# Rollback: re-run the same command with -AttackSurfaceReductionRules_Actions Disabled (0)
#           or AuditMode (2). Rule ID is unchanged, so the revert is symmetrical.

# 1. Record current state -- this is the rollback reference.
$p = Get-MpPreference
$ruleId = '3B576869-A4EC-4529-8536-B80A7769E899'   # Block executable content from email/webmail
$idx = [array]::IndexOf($p.AttackSurfaceReductionRules_Ids, $ruleId)
if ($idx -ge 0) { '{0} = {1}' -f $ruleId, $p.AttackSurfaceReductionRules_Actions[$idx] } else { "$ruleId not currently configured" }

# 2. Audit first.
Add-MpPreference -AttackSurfaceReductionRules_Ids $ruleId -AttackSurfaceReductionRules_Actions AuditMode

# 3. After a clean audit week, enforce.
Add-MpPreference -AttackSurfaceReductionRules_Ids $ruleId -AttackSurfaceReductionRules_Actions Enabled

# 4. Verify.
$p = Get-MpPreference
$idx = [array]::IndexOf($p.AttackSurfaceReductionRules_Ids, $ruleId)
'{0} = {1}' -f $ruleId, $p.AttackSurfaceReductionRules_Actions[$idx]

# 5. Tamper Protection must be on, or this is trivially reversible by anyone with local admin.
(Get-MpComputerStatus).IsTamperProtected

Playbook 3 — Block published PhantomEnigma C2 domains and IPs at the resolver/egress

# Prerequisites: DNS sinkhole or resolver-side blocklist capability, or an egress proxy /
#                firewall capable of FQDN and IP blocking. Confirm none of the four
#                compromised .gov.br context hosts in section 10 are accidentally included --
#                they are victim infrastructure and should NOT be blocked.
# Reboot required: no.
# Rollback: remove the entries added in step 1/2 from the resolver blocklist or firewall
#           rule set. No other system state is changed.

# 1. Resolver-side (example: Windows DNS Server RPZ zone, adapt to your resolver)
$domains = 'zsxocjarsate.com','psznaoehteeh.com','eeresofeuae.com','dahieenloo.com',
           'policiacivilmg.com','pccvill.com','taaeiuep.com'
foreach ($d in $domains) {
  Add-DnsServerQueryResolutionPolicy -Name "Block-PhantomEnigma-$d" `
    -Action IGNORE -FQDN "EQ,$d" -ErrorAction SilentlyContinue
}

# 2. Egress firewall / proxy (example: Windows host firewall for lab validation --
#    use your perimeter firewall or SWG for production enforcement)
$ips = '185.219.83.191','188.137.246.189','91.92.241.181','158.94.208.120'
foreach ($ip in $ips) {
  New-NetFirewallRule -DisplayName "HuntPack - Block PhantomEnigma $ip" `
    -Direction Outbound -RemoteAddress $ip -Action Block -Profile Any -ErrorAction SilentlyContinue
}

# 3. Verify
Get-NetFirewallRule -DisplayName 'HuntPack - Block PhantomEnigma*' |
  Get-NetFirewallAddressFilter | Select-Object RemoteAddress

Playbook 4 — Alert on new Run/RunOnce Registry values estate-wide

# Prerequisites: RegGenericValueUpdate / AsepValueUpdate telemetry confirmed flowing
#                (validation gate 1, section 11). This is a detection-only playbook --
#                it does not change endpoint state, so risk of breakage is minimal.
# Reboot required: no.
# Rollback: none required -- this deploys a Falcon Scheduled Search / Custom IOA, it does
#           not modify endpoint configuration. Disable or delete the saved search to revert.

# 1. Baseline current Run/RunOnce contents across a representative host sample, so you can
#    tell a genuinely new value from one that has always been there.
$paths = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
         'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
         'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    Select-Object * -ExcludeProperty PS*
} | Export-Csv C:\Backup\RunKey-baseline.csv -NoTypeInformation

# 2. Create the Falcon Scheduled Search from Q4 in section 8, scheduled every 15 minutes
#    with a 30-minute lookback, severity High, scoped estate-wide (no aid filter).

# 3. Verify the saved search returns the lab-created value from validation gate 3
#    (section 11) before considering this playbook deployed.

Do not assume a clean sandbox or AV verdict clears a host. All five sources agree the campaign's samples frequently receive clean verdicts, which is explicitly why ANY.RUN recommends detecting the build chain and behavioral pattern rather than relying on signature or reputation alone.

Ten queries, of which five are high confidence with no material FP source (Q1, Q2, Q3, Q4, Q9) and two more are high confidence but perishable (Q6, Q7). The pack's strongest coverage sits at installer execution and persistence — exactly where ANY.RUN's own guidance says to focus, since the build chain and install-directory pattern are described as more durable than the domain/IP list. Before deploying, clear validation gate 1 in section 11: if RegGenericValueUpdate/AsepValueUpdate is not flowing in your tenant, Q4 returns nothing forever. If you have no web-proxy/HTTP log ingestion, Q8 cannot run at all and the URI-beacon shape stays a permanent gap until that telemetry exists — Q6 and Q7 partially compensate by catching the underlying network connection even without URI visibility.

Source snapshots. The fetched text of all sources — including the one that failed to load (HackRead) — is preserved alongside this file in PhantomEnigma-Hunt-sources/. Every atomic indicator shipped in section 4 is traced back to those snapshots.