This hypothesis targets the deployment of the Remus ransomware family, which encrypts victim files to extort payment, often leveraging initial access vectors or lateral movement to compromise critical assets. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify early-stage infections or persistence mechanisms before the encryption process begins, thereby reducing the potential impact and recovery time of a high-severity ransomware event.
Malware Family: Remus Total IOCs: 19 IOC Types: domain, ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://sparlink.click:7528/attachments | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://synerfy.biz:6627/payments | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://assetvs.biz:4529/imports | botnet_cc | 2026-09-28 | 75% |
| ip:port | 77[.]37[.]41[.]59:9173 | botnet_cc | 2026-09-28 | 100% |
| url | hxxp://briture.click:6237/events | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://kipthen.shop:9932/permissions | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://sxdment.click:5003/documents | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://gerzone.click:4262/files | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://petcarv.click:8239/customers | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://caxools.click:7728/payments | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://gerzone.click:4262/projects | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://synerfy.biz:6627/subscriptions | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://assetvs.biz:4529/tags | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://petcarv.click:8239/products | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://caxools.click:7728/events | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://sxdment.click:5003/folders | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://jxewele.shop:4262/reviews | botnet_cc | 2026-09-28 | 75% |
| url | hxxp://obutdor.shop:5003/tags | botnet_cc | 2026-09-28 | 75% |
| domain | ventuxe.biz | botnet_cc | 2026-09-28 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remus
let malicious_ips = dynamic(["77.37.41.59"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["77.37.41.59"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remus
let malicious_domains = dynamic(["ventuxe.biz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://sparlink.click:7528/attachments", "http://synerfy.biz:6627/payments", "http://assetvs.biz:4529/imports", "http://briture.click:6237/events", "http://kipthen.shop:9932/permissions", "http://sxdment.click:5003/documents", "http://gerzone.click:4262/files", "http://petcarv.click:8239/customers", "http://caxools.click:7728/payments", "http://gerzone.click:4262/projects", "http://synerfy.biz:6627/subscriptions", "http://assetvs.biz:4529/tags", "http://petcarv.click:8239/products", "http://caxools.click:7728/events", "http://sxdment.click:5003/folders", "http://jxewele.shop:4262/reviews", "http://obutdor.shop:5003/tags"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
rsync or robocopy to perform a full backup of a development environment to an offsite storage server, triggering high-volume file modification events that mimic ransomware encryption behavior.
vssadmin.exe, wbadmin.exe, robocopy.exe) or exclude file extensions commonly associated with backups (.bak, .tmp, .zip) when the source path is within designated backup directories (e.g., C:\Backups\, \\fileserver\backups\).C:\Windows\Temp or application log folders, causing rapid file system changes.
C:\Windows\Temp, C:\ProgramData\*\Logs, C:\Users\*\AppData\Local\Temp) and exclude processes running from system administrative paths (e.g., C:\Windows\System32\, C:\Program Files\Microsoft\) when executed by service accounts or known admin groups.C:\Program Files or C:\Program Files (x86) as old versions are replaced.
C:\Program Files and C:\Program Files (x86) when the parent process is a known deployment agent (e.g., ccmexec.exe, `pd