ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Remus malware to exfiltrate sensitive data and establish covert command-and-control channels through compromised URLs delivered via phishing or malicious websites. Proactive hunting in Azure Sentinel is critical to identify unusual outbound traffic patterns and lateral movement that indicate active data theft before the adversary can fully entrench their presence within the network.

IOC Summary

Malware Family: Remus Total IOCs: 7 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://tokjoza.shop:5200/webhooks", "http://none/profiles", "http://beljaro.shop:2536/invoices", "http://tokjoza.shop:5200/attachments", "http://shkpiva.shop:5627/tokens", "http://beljaro.shop:2536/accounts", "http://luwmera.shop:5200"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Legitimate Cloud Backup Synchronization: Enterprise backup solutions like Veeam or Rubrik frequently initiate large outbound connections to cloud storage endpoints (e.g., AWS S3, Azure Blob) during scheduled windows. These transfers often utilize dynamic URLs and high-volume data streams that mimic the exfiltration behavior of Remus malware.

  • Suggested Filter: Create an exclusion rule for source IP ranges belonging to known backup appliances or specific service accounts (e.g., svc-veeam-backup) connecting to trusted cloud storage CIDR blocks, excluding traffic on standard backup ports (e.g., 443, 8080) during defined maintenance windows.

• Automated Software Update Deployment: Centralized patch management tools such as Microsoft Endpoint Configuration Manager (ConfigMgr) or Jamf regularly download update packages from vendor repositories via HTTPS. These downloads often involve connecting to diverse, dynamically generated URLs and can trigger alerts regarding “unusual outbound traffic” similar to Remus’s downloader scripts.

  • Suggested Filter: Exclude traffic originating from the management server hostname (e.g., SCCM-Primary) or specific update service accounts when destination domains match known vendor repositories (e.g., *.microsoft.com, *.jamfsoftware.com).

• Scheduled Data Analytics ETL Jobs: Business Intelligence platforms like Tableau Server or Power BI Gateway execute nightly Extract, Transform, Load (ETL) jobs that pull data from external APIs and internal databases. These processes generate consistent outbound connections to various URLs for data ingestion, which can be misidentified as covert command-and-control channels.

  • Suggested Filter: Implement a whitelist for the specific service accounts running these ETL jobs (e.g., svc-tableau-etl) and filter out traffic directed toward known external API endpoints used by the analytics platform during their scheduled execution times.