ThreatFox: Remus IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by identifying network and host artifacts matching 21 specific Indicators of Compromise (IOCs) linked to the Remus threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity campaign enables rapid containment before adversaries can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Remus Total IOCs: 21 IOC Types: ip:port, url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://tokjoza.shop:5200/users`	botnet_cc	2026-08-16	75%
url	`hxxp://shkpiva.shop:5627/tasks`	botnet_cc	2026-08-16	75%
url	`hxxp://mrlketo.shop:8932/collections`	botnet_cc	2026-08-16	75%
url	`hxxp://vexdico.shop:8539/payments`	botnet_cc	2026-08-16	75%
url	`hxxp://shkpiva.shop:5627/exports`	botnet_cc	2026-08-16	75%
url	`hxxp://glimqra.click:6534/contacts`	botnet_cc	2026-08-16	75%
url	`hxxp://shkpiva.shop:5627/reports`	botnet_cc	2026-08-16	75%
url	`hxxp://mrlketo.shop:8932/notifications`	botnet_cc	2026-08-16	75%
url	`hxxp://spareon.click:8811/reviews`	botnet_cc	2026-08-16	75%
url	`hxxp://spareon.click:8811/imports`	botnet_cc	2026-08-16	75%
url	`hxxp://mrlketo.shop:8932/attachments`	botnet_cc	2026-08-16	75%
url	`hxxp://shkpiva.shop:5627/projects`	botnet_cc	2026-08-16	75%
ip:port	`94[.]183[.]184[.]53:6534`	botnet_cc	2026-08-16	75%
url	`hxxp://glimqra.click:6534/files`	botnet_cc	2026-08-16	75%
url	`hxxp://vexdico.shop:8539/users`	botnet_cc	2026-08-15	75%
url	`hxxp://kupzovo.shop:7567/subscriptions`	botnet_cc	2026-08-15	75%
url	`hxxp://mrlketo.shop:8932/permissions`	botnet_cc	2026-08-15	75%
ip:port	`66[.]228[.]41[.]52:7567`	botnet_cc	2026-08-15	75%
url	`hxxp://kupzovo.shop:7567/posts`	botnet_cc	2026-08-15	75%
url	`hxxp://kupzovo.shop:7567/categories`	botnet_cc	2026-08-15	75%
url	`hxxp://bravplo.click:7713/teams`	botnet_cc	2026-08-15	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["66.228.41.52", "94.183.184.53"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["66.228.41.52", "94.183.184.53"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tokjoza.shop:5200/users", "http://shkpiva.shop:5627/tasks", "http://mrlketo.shop:8932/collections", "http://vexdico.shop:8539/payments", "http://shkpiva.shop:5627/exports", "http://glimqra.click:6534/contacts", "http://shkpiva.shop:5627/reports", "http://mrlketo.shop:8932/notifications", "http://spareon.click:8811/reviews", "http://spareon.click:8811/imports", "http://mrlketo.shop:8932/attachments", "http://shkpiva.shop:5627/projects", "http://glimqra.click:6534/files", "http://vexdico.shop:8539/users", "http://kupzovo.shop:7567/subscriptions", "http://mrlketo.shop:8932/permissions", "http://kupzovo.shop:7567/posts", "http://kupzovo.shop:7567/categories", "http://bravplo.click:7713/teams"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Remus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Remus IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Security Tool Updates
- Context: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs scheduled nightly updates. These tools often pull definition files or configuration manifests from the vendor’s cloud, which may contain file hashes or network destinations matching the Remus IOCs.
- Filter/Exclusion: Create a rule exclusion based on the Process Name of the security agent (e.g., FalconSensor.exe, SentinelOneAgent.exe) AND restrict the match to specific update windows (e.g., 02:00–04:00 local time). Alternatively, exclude traffic originating from the internal IP range of the Software Distribution Server (e.g., SCCM or WSUS servers) that hosts these updates.
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions like Veeam, Commvault, or Rubrik run scheduled jobs to archive data to cloud repositories. If the Remus IOCs include specific file hashes used in standard compression algorithms or network ports utilized by these backup agents, legitimate backup traffic will trigger alerts.
- Filter/Exclusion: Filter out events where the User Account is a dedicated service account (e.g., svc_backup_prod, VeeamSystem) AND the Process Path matches the known installation directory of the backup software (e.g., C:\Program Files\Veeam\Backup and Replication\...).
Scenario: Third-Party SaaS Integration Sync
- Context: The enterprise utilizes a cloud-based IT Service