T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2

The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit's own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload. The payload is not encrypted in any meaningful sense — it is a byte-wise XOR against a 32-byte keystream derived from the _fbc Meta Pixel click-identifier cookie the page sets, so a defender with the request and the cookie recovers the plaintext offline. This rule matches the X-Enc header on a POST (the strongest single indicator, as the header is specific to this kit) and, separately, a POST of a text/plain body to one of the single-letter routes served by a Next.js asset host. The routes alone are generic; require the text/plain body or the X-Enc header to scope. Because the exfil is first-party rather than to Telegram, a Telegram-based detection will not see this kit — this channel is its strongest discriminator.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK techniques are exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1027.013	0	0	—
T1557 Adversary-in-the-Middle	4	0	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2025-31200	Apple / Multiple Products	0.186	—
CVE-2019-5591	Fortinet / FortiOS	0.184	ransomware
CVE-2025-31201	Apple / Multiple Products	0.139	—

Rule ID: 364fbafd-91fb-4816-9dc9-be90b870f0fb
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1027.013 , T1557 (signal rollup)
Canonical YAML: t1557-claims-kit-single-letter-c2-xenc.yml

References

False positives

Applications that legitimately POST text/plain bodies to short API routes. The single-letter paths are generic; keep them paired with the text/plain content type, and where possible add the requirement that the host is not a sanctioned application. The X-Enc header selection is specific to this kit and should rarely false-positive.
Beacon, telemetry, or analytics endpoints that use single-character paths. Allowlist the known destinations rather than removing the route list.
Proxy or WAF products that do not log request headers will not populate the X-Enc field; in those environments rely on selection_singleletter_textplain and confirm at the host.

Rule YAML

title: 'T1557 Claims Kit First-Party Exfil — X-Enc Single-Letter C2'
id: '364fbafd-91fb-4816-9dc9-be90b870f0fb'
status: 'experimental'
description: 'The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit''s own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload. The payload is not encrypted in any meaningful sense — it is a byte-wise XOR against a 32-byte keystream derived from the _fbc Meta Pixel click-identifier cookie the page sets, so a defender with the request and the cookie recovers the plaintext offline. This rule matches the X-Enc header on a POST (the strongest single indicator, as the header is specific to this kit) and, separately, a POST of a text/plain body to one of the single-letter routes served by a Next.js asset host. The routes alone are generic; require the text/plain body or the X-Enc header to scope. Because the exfil is first-party rather than to Telegram, a Telegram-based detection will not see this kit — this channel is its strongest discriminator.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
    - 'https://attack.mitre.org/techniques/T1027/013/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.exfiltration'
    - 'attack.defense_evasion'
    - 'attack.t1027.013'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_xenc_header:
        cs-method: 'POST'
        X-Enc: '1'
    selection_singleletter_textplain:
        cs-method: 'POST'
        cs-content-type|contains: 'text/plain'
        cs-uri-stem:
            - '/e'
            - '/w'
            - '/z'
            - '/d'
            - '/y'
            - '/m'
            - '/x'
    condition: 'selection_xenc_header or selection_singleletter_textplain'
falsepositives:
    - 'Applications that legitimately POST text/plain bodies to short API routes. The single-letter paths are generic; keep them paired with the text/plain content type, and where possible add the requirement that the host is not a sanctioned application. The X-Enc header selection is specific to this kit and should rarely false-positive.'
    - 'Beacon, telemetry, or analytics endpoints that use single-character paths. Allowlist the known destinations rather than removing the route list.'
    - 'Proxy or WAF products that do not log request headers will not populate the X-Enc field; in those environments rely on selection_singleletter_textplain and confirm at the host.'
level: 'high'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1557-claims-kit-single-letter-c2-xenc.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.