ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the KongTuke campaign by scanning Azure Sentinel logs against a curated set of 76 Indicators of Compromise (IOCs) known to facilitate initial access and lateral movement. Proactively hunting for these specific IOCs is critical because early detection of KongTuke artifacts allows the SOC team to identify potential compromises before they escalate into broader data exfiltration or ransomware events within the cloud environment.

IOC Summary

Malware Family: KongTuke Total IOCs: 76 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`ritchie.click`	botnet_cc	2026-07-21	50%
domain	`meduurst.space`	botnet_cc	2026-07-21	50%
domain	`monteiro.click`	botnet_cc	2026-07-21	50%
domain	`bitista.icu`	botnet_cc	2026-07-21	50%
domain	`thibahlt.lol`	botnet_cc	2026-07-21	50%
domain	`leconto.lol`	botnet_cc	2026-07-21	50%
domain	`carreiro.lol`	botnet_cc	2026-07-21	50%
domain	`henreques.lol`	botnet_cc	2026-07-21	50%
domain	`fraitas.lol`	botnet_cc	2026-07-21	50%
domain	`azevedo.lol`	botnet_cc	2026-07-21	50%
domain	`schester.beer`	botnet_cc	2026-07-21	50%
domain	`abernaahy.sbs`	botnet_cc	2026-07-21	50%
domain	`riviere.sbs`	botnet_cc	2026-07-21	50%
domain	`ackeamann.xyz`	botnet_cc	2026-07-21	50%
domain	`lombaidi.lol`	botnet_cc	2026-07-21	50%
domain	`robests.lol`	botnet_cc	2026-07-21	50%
domain	`reindardt.lol`	botnet_cc	2026-07-21	50%
domain	`schuttc.lol`	botnet_cc	2026-07-21	50%
domain	`bogisibh.xyz`	botnet_cc	2026-07-21	50%
domain	`ledesla.cfd`	botnet_cc	2026-07-21	50%
domain	`uolguin.cfd`	botnet_cc	2026-07-21	50%
domain	`olovier.lol`	botnet_cc	2026-07-21	50%
domain	`chauvet.club`	botnet_cc	2026-07-21	50%
domain	`gautter.lol`	botnet_cc	2026-07-21	50%
domain	`riihard.top`	botnet_cc	2026-07-21	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["ritchie.click", "meduurst.space", "monteiro.click", "bitista.icu", "thibahlt.lol", "leconto.lol", "carreiro.lol", "henreques.lol", "fraitas.lol", "azevedo.lol", "schester.beer", "abernaahy.sbs", "riviere.sbs", "ackeamann.xyz", "lombaidi.lol", "robests.lol", "reindardt.lol", "schuttc.lol", "bogisibh.xyz", "ledesla.cfd", "uolguin.cfd", "olovier.lol", "chauvet.club", "gautter.lol", "riihard.top", "nonrueden.com", "northcombe.org", "omnivectis.com", "willimsen.com", "ssntana.com", "fundivox.com", "exoosito.com", "oelgado.com", "nitzschi.com", "vtcircuits.com", "satserfield.com", "quilborne.org", "quiglgy.com", "kovkcek.com", "gccsinc.com", "barsows.com", "ethervane.com", "raventhorp.org", "bradtkr.com", "dialectum.com", "oakington.org", "quorumix.com", "saxonfield.org", "sigmatauethifarma.com", "hegmaen.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — KongTuke

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for an enterprise environment using common security and IT management tools:

Scheduled Antivirus Definition Updates via WSUS/SCCM
- Scenario: The enterprise uses Microsoft SCCM (Configuration Manager) to push Windows Defender or Symantec Endpoint Protection updates. These packages often contain compressed archives or installer scripts that match the KongTuke hash signatures found in legitimate software distribution repositories, triggering alerts during the nightly maintenance window.
- Filter/Exclusion: Create a rule exclusion for traffic originating from the internal SCCM Distribution Point IP range (e.g., 10.x.x.x) destined to the specific file paths of the update repository (e.g., \Software Updates\Windows Defender\).
IT Asset Management Scans by Lansweeper or SolarWinds
- Scenario: Automated discovery agents from tools like Lansweeper or SolarWinds NPM scan endpoints to inventory installed software. These agents frequently download and execute temporary diagnostic scripts or agent updates that share IOCs with the KongTuke malware family, particularly when scanning legacy servers running older versions of these management agents.
- Filter/Exclusion: Exclude network flows where the source process is LansweeperAgent.exe or SolarWinds.AgentService.exe and the destination port corresponds to internal asset management servers (e.g., Port 8080 or 443 on the Asset Server IP).
Third-Party Patch Management Deployments via Ivanti or ManageEngine
- Scenario: During a scheduled patch Tuesday cycle, the Ivanti Endpoint Manager deploys vendor-specific patches for Java or Adobe. The installation packages often include signed binaries that match KongTuke IOCs because these vendors frequently bundle similar cryptographic libraries or use shared code bases with known benign