ThreatFox: KongTuke IOCs

Hunt Hypothesis

This detection rule identifies the initial infection phase of the KongTuke malware by monitoring for Command-and-Control communications and persistence mechanisms associated with its downloader/backdoor capabilities. Proactive hunting is essential to rapidly isolate compromised endpoints before the adversary can establish long-term footholds and exfiltrate sensitive data through phishing-driven entry points.

IOC Summary

Malware Family: KongTuke Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["tommy-ee.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://bouoher.lol/api/v1/status", "https://tommy-ee.top/f"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Phishing Simulation Campaigns

  • Context: Security teams frequently use tools like KnowBe4, Proofpoint Essentials, or GoPhish to run internal phishing simulations. These campaigns often deploy malicious-looking URLs that mimic real-world threats, triggering the KongTuke C2 detection logic when employees click simulated links.
  • Filter/Exclusion: Create a whitelist exclusion for traffic originating from the specific IP ranges of your simulation platform (e.g., 198.51.100.0/24 for KnowBe4) or exclude URLs containing known simulation domains (e.g., *.knowbe4.com, *.proofpoint.com) where the destination URL path contains /simulation or /campaign.

• Scenario: Enterprise Backup and Exfiltration Jobs

  • Context: KongTuke is characterized by data exfiltration via C2. Legitimate scheduled backup jobs using tools like Veeam Backup & Replication, Rubrik, or Commvault often initiate high-volume outbound connections to cloud storage buckets (AWS S3, Azure Blob) that match the traffic patterns of a backdoor exfiltrating data.
  • Filter/Exclusion: Exclude network flows where the destination port is standard backup ports (e.g., 443, 873 for NFS, or specific vendor ports like 9025) and the source process is identified as the backup agent executable (e.g., VeeamTransportService.exe, rubrik-agent.exe). Additionally, exclude traffic destined to known cloud storage IP ranges during defined maintenance windows.

• **Scenario: Software Update Mechanisms for Endpoint