ThreatFox: Remus IOCs

Hunt Hypothesis

This hunt targets the presence of 11 known Indicators of Compromise (IOCs) associated with the Remus threat actor, which may indicate an active intrusion or persistent foothold within the environment. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Remus Total IOCs: 11 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Remus
let malicious_urls = dynamic(["http://boltore.click:7652/tasks", "http://phetsre.shop:3452/sessions", "http://fgashub.shop:9932/customers", "http://phetsre.shop:3452/posts", "http://hkealop.shop:9932/documents", "http://alutove.shop:5627/tags", "http://homecor.click:6527/posts", "http://hkealop.shop:9932/orders", "http://alutove.shop:5627/subscriptions", "http://kipthen.shop:9932/articles", "http://tfoyses.shop:3452/permissions"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Remus

False Positive Guidance

• Scenario: The Remus IOC set includes known IP addresses or domain names that are part of the enterprise’s internal load balancer infrastructure or third-party SaaS provider endpoints (e.g., a specific *.remus.io subdomain used by a niche CI/CD tool or a legacy monitoring agent).

  • Filter/Exclusion: Exclude traffic where the source or destination IP belongs to the internal 10.0.0.0/8 or 172.16.0.0/12 ranges, or specifically exclude the known SaaS provider’s ASN (e.g., AS15169 for Google Cloud) if the IOC matches a public cloud endpoint.

• Scenario: A scheduled maintenance job on a Linux build server uses a script that downloads a dependency package from a repository whose hostname matches one of the Remus IOCs (e.g., a generic remus-packages.com domain used by a niche open-source library).

  • Filter/Exclusion: Exclude events where the process name is curl, wget, or python and the parent process is a known build tool like jenkins-agent, gitlab-runner, or ansible-playbook, and the destination port is 443.

• Scenario: An endpoint detection agent (such as CrowdStrike or SentinelOne) performs a self-update or fetches a configuration blob from a CDN whose IP address coincidentally matches one of the static IP IOCs in the Remus set.

  • Filter/Exclusion: Exclude network connections where the source process is a known EDR agent binary (e.g., FalconSensor.exe, SentinelOneAgent.exe, or osqueryd) and the destination port is 443 or 80.

• Scenario: A developer’s laptop connects to a staging