ThreatFox: Remus IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the initial access and propagation phases of the Remus ransomware family, which typically leverages malicious URLs and stolen credentials to deliver payloads and encrypt files. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or anomalous network traffic before the encryption process begins, thereby reducing the potential impact of the high-severity threat.

IOC Summary

Malware Family: Remus Total IOCs: 5 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://beautck.click:8291/orders`	botnet_cc	2026-09-17	75%
url	`hxxp://kipthen.shop:9932/tokens`	botnet_cc	2026-09-17	75%
url	`hxxp://fuarnpp.shop:5627/subscriptions`	botnet_cc	2026-09-17	75%
url	`hxxp://tfoyses.shop:3452/tags`	botnet_cc	2026-09-17	75%
url	`hxxp://kipthen.shop:9932/accounts`	botnet_cc	2026-09-17	75%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://beautck.click:8291/orders", "http://kipthen.shop:9932/tokens", "http://fuarnpp.shop:5627/subscriptions", "http://tfoyses.shop:3452/tags", "http://kipthen.shop:9932/accounts"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Remus

False Positive Guidance

Scenario: Legitimate Software Deployment via Remus-Associated CDN or Domain
- Context: An enterprise uses a third-party deployment tool (e.g., Ansible, Puppet, or a custom internal script) that fetches configuration files or binary payloads from a CDN or domain listed in the ThreatFox Remus IOCs because the vendor hosts assets on a shared infrastructure or has a known false-positive domain overlap.
- Filter/Exclusion: Exclude network connections where the source process is a known deployment agent (e.g., ansible-playbook.exe, puppet-agent, or python.exe running from the deployment directory) and the destination port is 443 (HTTPS) or 80 (HTTP), provided the source user account is a service account (e.g., svc-deploy, admin-automation).
Scenario: Scheduled Backup or Sync Job Accessing IOCs
- Context: A scheduled task (e.g., Windows Task Scheduler job named “Nightly-Backup” or “Sync-to-Share”) runs a script that connects to a file share or API endpoint whose IP or domain matches a Remus IOC. This often happens if the backup target is hosted on a cloud provider or internal server that shares an IP range or domain with a known Remus C2 node.
- Filter/Exclusion: Exclude events where the initiating process is a backup/sync tool (e.g., vssadmin.exe, wbadmin.exe, rsync, robocopy.exe, or python.exe with a backup-related command line) and the scheduled task name contains keywords like “backup,” “sync,” or “archive.”
Scenario: Developer or QA Environment Testing
- Context: A developer or QA engineer manually tests a new application or integration by accessing a staging environment or test server that happens to use