DPRK Hangro VPN Infrastructure + Hotejka Help TDS: OTX Pulse Analysis — Certificate Anomalies, Tech Support Scam Delivery & Enterprise Detection Pack

---
title: DPRK Hangro Infrastructure TLS or DNS Contact
description: Detects DNS resolution or TLS SNI contact with known Hangro / DPRK state VPN and mail relay infrastructure identified in OTX pulse (July 2026 certificate hierarchy refresh).
status: experimental
date: 2026/10/22
author: Security Arsenal Threat Intel
logsource:
    category: dns
    product: windows
    service: dns-client
detection:
    selection:
        QueryName|contains:
            - 'silibank.net.kp'
            - 'star-co.net.kp'
            - 'hangro.net.kp'
            - 'silibank.com'
            - 'ppokkugi.com'
    condition: selection
falsepositives:
    - Threat research sandbox activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1572
---
title: Hotejka Help TDS Domain Resolution
description: Detects DNS queries to Hotejka / ROI777 Help TDS infrastructure used to deliver fake Microsoft tech support scam pages via Cloudflare Pages and malvertising redirect chains.
status: experimental
date: 2026/10/22
author: Security Arsenal Threat Intel
logsource:
    category: dns
detection:
    selection:
        QueryName|contains:
            - 'roi777.com'
            - 'roi-traffic.icu'
            - 'hotejka.ink'
            - 'lib1.biz'
            - 'fosetya.shop'
            - 'goalods.lol'
            - 'hotcname.help'
    condition: selection
falsepositives:
    - Security research
detection_notes: Follow up by checking whether the requesting host subsequently installed UltraViewer or an unknown RMM tool.
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - attack.command_and_control
---
title: UltraViewer Remote Access Tool Installation or Execution
description: Detects installation, service registration, or execution of UltraViewer, the RAT abused by Hotejka tech support scam operators for full interactive victim control.
status: experimental
date: 2026/10/22
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\UltraViewer.exe'
            - '\UltraViewer_setup.exe'
    selection_cmd:
        CommandLine|contains:
            - 'UltraViewer'
    selection_svc:
        CommandLine|contains:
            - 'sc create'
            - 'UltraViewer'
    condition: 1 of selection_*
falsepositives:
    - Legitimate IT helpdesk deployments (maintain an approved-RMM allowlist; anything not on it is suspicious)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
    - attack.t1543.003

// Security Arsenal — Hotejka TDS + UltraViewer + DPRK Hangro Hunt (Sentinel)
// Part 1: Network contact with pulse IOCs
let TDS_Domains = dynamic(["roi777.com","roi-traffic.icu","hotejka.ink","lib1.biz","fosetya.shop","goalods.lol","hotcname.help"]);
let DPRK_Hosts = dynamic(["mail.silibank.net.kp","smtp.star-co.net.kp","mail.silibank.com","hangro.net.kp","silibank.com","ps.ppokkugi.com"]);
let SuspiciousIP = "91.196.33.144";
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in~ (TDS_Domains) or RemoteUrl in~ (DPRK_Hosts) or RemoteIP == SuspiciousIP
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType;
// Part 2: UltraViewer install/execution on endpoints
let RATHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "UltraViewer.exe" or ProcessCommandLine has "UltraViewer"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
// Part 3: Browser-lock scam page contact preceding RAT install (correlate)
let ScamPages = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has "pages.dev" and InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe")
| project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName;
union NetworkHits, RATHits
| sort by TimeGenerated desc

# Security Arsenal — Hotejka/UltraViewer + Hangro IOC Hunt
# Run elevated on endpoints (or via Intune/Defender Live Response). Outputs CSV of hits.
$report = @()

# 1) UltraViewer install artifacts: services, run keys, install dirs
$uvServices = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'UltraViewer' -or $_.PathName -match 'UltraViewer' }
foreach ($s in $uvServices) { $report += [pscustomobject]@{Type='Service'; Indicator=$s.Name; Detail=$s.PathName; State=$s.State} }

$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'UltraViewer' } |
        ForEach-Object { $report += [pscustomobject]@{Type='RunKey'; Indicator=$_.Name; Detail=$_.Value; State=$k} }
    }
}

$uvPaths = "$env:ProgramFiles\UltraViewer","${env:ProgramFiles(x86)}\UltraViewer","$env:APPDATA\UltraViewer"
foreach ($p in $uvPaths) { if (Test-Path $p) { $report += [pscustomobject]@{Type='FilePath'; Indicator=$p; Detail='UltraViewer install directory present'; State='Exists'} } }

# 2) Hangro tooling file hashes (EDR-independent sweep of common staging dirs)
$hashes = @('b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01','5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b')
Get-ChildItem -Path "$env:TEMP","$env:USERPROFILE\Downloads","C:\ProgramData" -Recurse -File -ErrorAction SilentlyContinue |
ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($hashes -contains $h.ToLower()) { $report += [pscustomobject]@{Type='FileHash'; Indicator=$h; Detail=$_.FullName; State='MALICIOUS'} }
}

# 3) Active/recent network connections to TDS IPv4 and DNS cache hits for pulse domains
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq '91.196.33.144' }
foreach ($c in $conns) { $report += [pscustomobject]@{Type='NetConn'; Indicator=$c.RemoteAddress; Detail="State=$($c.State) LocalPort=$($c.LocalPort)"; State=$c.OwningProcess} }

$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'silibank|star-co\.net\.kp|hangro\.net\.kp|ppokkugi|roi777|roi-traffic|hotejka|lib1\.biz|fosetya|goalods|hotcname' }
foreach ($d in $dnsCache) { $report += [pscustomobject]@{Type='DNSCache'; Indicator=$d.Entry; Detail=$d.Data; State='Resolved'} }

# 4) Scheduled tasks referencing UltraViewer (persistence)
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'UltraViewer') -or ($_.TaskName -match 'UltraViewer') } |
ForEach-Object { $report += [pscustomobject]@{Type='SchTask'; Indicator=$_.TaskName; Detail=$_.Actions.Execute; State=$_.State} }

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:ProgramData\OTX_Hunt_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "Hunt complete. $($report.Count) indicator(s) found. CSV written to ProgramData."