← Back to SOC feed Coverage →

ThreatFox: KongTuke IOCs

ioc-hunt HIGH ThreatFox
DnsEventsUrlClickEvents
iocjs-kongtukethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-05-06T11:00:00Z · Confidence: high

Hunt Hypothesis

The ThreatFox: KongTuke IOCs rule detects potential adversary activity linked to the KongTuke threat group, which is associated with high-severity malicious campaigns. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage compromises that could lead to data exfiltration or lateral movement.

IOC Summary

Malware Family: KongTuke Total IOCs: 2 IOC Types: domain, url

TypeValueThreat TypeFirst SeenConfidence
urlhxxps://dvxfigqyzgd.com/dpayload_delivery2026-05-06100%
domaindvxfigqyzgd.compayload_delivery2026-05-06100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["dvxfigqyzgd.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://dvxfigqyzgd.com/d"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled
UrlClickEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://threatfox.abuse.ch/browse/malware/js.kongtuke/