Six Minutes to Compromise: How Actor Behind ‘Patriot Bait’ Used AI to Build and Deploy a C&C Botnet 

------------------------------------------------------------------------------

INDICATORS OF COMPROMISE

IP 			213.165.51.115 
IP 			34.34.57.141 
IP 			34.34.81.129 
Domain 			tralalarkefe.com 
Domain 			*.tralalarkefe.com 
HTTP Header 		X-Agent-ID: HOSTNAME_USERNAME 
File Path 		%APPDATA%\Microsoft\Windows\Runtime\svchost.exe 
Registry 		HKCU:\...\Run\WindowsUpdateManager 
Registry 		HKCU:\Environment\UserInitMprLogonScript 
WMI Filter 		Win32_SystemHealth 
WMI Consumer 		Win32_HealthConsumer 
Scheduled Task 		Microsoft\Windows\WindowsUpdate\Automatic App Update 
Scheduled Task 		OneDrive Standalone Update Task-S-1-5-21-* 

------------------------------------------------------------------------------

MITRE ATT&CK / ATLAS Mapping 

Tactic 			ID 			Technique 
Execution 		T1059.001 		PowerShell 
Persistence 		T1546.003 		WMI Event Subscription 
Persistence 		T1053.005 		Scheduled Task/Job 
Persistence 		T1547.001 		Registry Run Keys 
Defense Evasion 	T1036.005 		Masquerading: Match Legitimate Name 
Defense Evasion 	T1132.001 		Data Encoding: Standard Encoding 
Defense Evasion 	T1572 			Protocol Tunneling 
Command and Control 	T1071.001 		Web Protocols 
Command and Control 	T1102 			Web Service 
ML/AI 			AML.T0054 		LLM Jailbreak