This hunt targets the 18 known indicators of compromise associated with the Remus threat actor to identify potential unauthorized access or lateral movement within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to detect early-stage intrusion attempts and mitigate the high-severity risks posed by this active threat group before they establish a foothold.
Malware Family: Remus Total IOCs: 18 IOC Types: ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://nopxs.shop:8839/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://coyxte.top:7688/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://teechop.shop:8213/imports | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://teculse.click:9210/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/contacts | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/permissions | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/products | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/webhooks | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/collections | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/notifications | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://teechop.shop:8213/customers | botnet_cc | 2026-09-12 | 75% |
| ip:port | 72[.]61[.]90[.]253:6421 | botnet_cc | 2026-09-12 | 100% |
| url | hxxp://eascess.click:6421/tasks | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/customers | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/reviews | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://faslick.click:6728/webhooks | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://arqtsop.shop:9932/workspaces | botnet_cc | 2026-09-12 | 75% |
| url | hxxp://trwehop.shop:5627/collections | botnet_cc | 2026-09-12 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["72.61.90.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["72.61.90.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://nopxs.shop:8839/contacts", "http://coyxte.top:7688/contacts", "http://teechop.shop:8213/imports", "http://teculse.click:9210/contacts", "http://arqtsop.shop:9932/contacts", "http://trwehop.shop:5627/permissions", "http://arqtsop.shop:9932/products", "http://trwehop.shop:5627/webhooks", "http://arqtsop.shop:9932/collections", "http://trwehop.shop:5627/notifications", "http://teechop.shop:8213/customers", "http://eascess.click:6421/tasks", "http://arqtsop.shop:9932/customers", "http://trwehop.shop:5627/reviews", "http://faslick.click:6728/webhooks", "http://arqtsop.shop:9932/workspaces", "http://trwehop.shop:5627/collections"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Maintenance: A third-party legacy ERP system (e.g., SAP or Oracle) running on a Windows Server 2012 host uses an outdated, unpatched Java JRE version that matches one of the Remus IOCs. The application service account runs the process with standard user privileges, not elevated.
java.exe, jrebin\java.exe) and the user account belongs to a specific service group (e.g., AppSvcAccounts) rather than an interactive user.Test/Dev Environment Artifacts: Developers in a non-production test environment install a specific version of a build tool (e.g., a specific maven or gradle version) that shares a hash or path signature with a Remus IOC due to versioning quirks. These hosts are tagged as Dev-Test in the CMDB.
Environment: Dev or Environment: Test in the asset inventory, or where the process path contains \dev\ or \test\ directories.Scheduled Backup Jobs: A nightly backup job (e.g., using Veeam or Commvault) runs a helper utility on file servers that matches a Remus IOC. The process is spawned by the backup agent service and runs under a dedicated BackupAdmin account.
VeeamBackupSvc.exe, commvault\cv.exe) and the user account name contains Backup or Svc.Patch Management Agents: Windows Update or SCCM clients download and execute a temporary installer or verification script that matches a Remus IOC. These processes are short-lived and run under the