Hotejka (ROI777) Help TDS Tech Support Scam Infrastructure: UltraViewer Social Engineering Campaign — OTX Pulse Analysis

---
title: UltraViewer Remote Access Tool Execution - Tech Support Scam TTP
id: 7f3a1b2e-9c4d-4e5a-8b6f-hotejka0001
description: Detects execution of UltraViewer remote desktop software, commonly installed via tech support scam social engineering attributed to the Hotejka/ROI777 Help TDS campaign. UltraViewer is legitimate software but is frequently abused by scam call centers for unauthorized remote access.
author: Security Arsenal Threat Intelligence
date: 2026/11/08
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\UltraViewer_Desktop.exe'
      - '\UltraViewer_Service.exe'
      - '\UltraViewer_setup.exe'
  selection_hash:
    Hashes|contains:
      - 'IMPHASH'  # Populate with known UltraViewer installer imphashes from threat feeds
  condition: selection_img or selection_hash
falsepositives:
  - Organizations legitimately using UltraViewer as approved RMM (rare in Western enterprise environments)
  - IT support teams with sanctioned UltraViewer deployments
level: high
tags:
  - attack.command_and_control
  - attack.t1219  # Remote Access Software
  - attack.t1659  # Content Injection (TDS landing)
---
title: Outbound Connection to Hotejka/ROI777 Help TDS Infrastructure
id: 7f3a1b2e-9c4d-4e5a-8b6f-hotejka0002
description: Detects DNS queries or network connections to known Hotejka/ROI777 Help Traffic Distribution System domains observed in OTX pulse. Hits indicate browser redirection into tech support scam funnel.
author: Security Arsenal Threat Intelligence
date: 2026/11/08
status: experimental
logsource:
  category: dns
  product: windows
detection:
  selection:
    query:
      - 'roi777.com'
      - 'roi-traffic.icu'
      - 'hotejka.ink'
      - 'hotejka.com'
      - 'hotcname.help'
      - 'lib1.biz'
      - 'fosetya.shop'
      - 'goalods.lol'
  condition: selection
falsepositives:
  - Threat research and security vendor scanning activity
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001  # Web Protocols
  - attack.t1189  # Drive-by Compromise
---
title: UltraViewer Service Installation for Persistent Remote Access
id: 7f3a1b2e-9c4d-4e5a-8b6f-hotejka0003
description: Detects creation of the UltraViewer Windows service, a persistence mechanism installed when tech support scam operators convince victims to install the RMM tool. Event ID 7045 (Service Control Manager).
author: Security Arsenal Threat Intelligence
date: 2026/11/08
status: experimental
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    Service_Name|contains:
      - 'UltraViewer'
    ImagePath|contains:
      - 'UltraViewer'
  condition: selection
falsepositives:
  - Sanctioned UltraViewer deployments (validate against approved software inventory)
level: high
tags:
  - attack.persistence
  - attack.t1543.003  # Windows Service
  - attack.t1219  # Remote Access Software

// Hotejka / ROI777 Help TDS + UltraViewer Hunt — Microsoft Sentinel
// Hunts for DNS/network hits to TDS infrastructure and UltraViewer execution artifacts
let TdsDomains = dynamic([
    "roi777.com", "roi-traffic.icu", "hotejka.ink", "hotejka.com",
    "hotcname.help", "lib1.biz", "fosetya.shop", "goalods.lol"
]);
let DnsHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl in~ (TdsDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, LocalIP
    | extend SignalType = "TDS Domain Contact";
let UltraViewerProc =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName has_any ("UltraViewer_Desktop.exe", "UltraViewer_Service.exe", "UltraViewer_setup.exe")
       or ProcessCommandLine has "UltraViewer"
    | project TimeGenerated, DeviceName, AccountName, FileName,
              ProcessCommandLine, FolderPath, SHA256
    | extend SignalType = "UltraViewer Execution";
let UltraViewerNet =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName has "UltraViewer"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              RemoteIP, RemotePort, RemoteUrl
    | extend SignalType = "UltraViewer C2/Relay Traffic";
union DnsHits, UltraViewerProc, UltraViewerNet
| sort by TimeGenerated desc
| summarize Signals = make_set(SignalType), FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated), Detail = take_any(Detail) by DeviceName, SignalType
| order by LastSeen desc

# Security Arsenal — Hotejka/ROI777 Help TDS + UltraViewer IOC Hunt
# Run elevated on suspected endpoints or deploy via RMM/Intune across fleet
# Checks: installed services, running processes, install paths, autostart, DNS cache

$report = [System.Collections.Generic.List[object]]::new()

# 1. UltraViewer services (persistence via Windows Service - T1543.003)
$services = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -like '*UltraViewer*' -or $_.PathName -like '*UltraViewer*' }
foreach ($svc in $services) {
    $report.Add([pscustomobject]@{
        Check = 'Service'; Indicator = $svc.Name
        Detail = "$($svc.State) | $($svc.PathName)"; Host = $env:COMPUTERNAME
    })
}

# 2. Running UltraViewer processes
$procs = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -like '*UltraViewer*' }
foreach ($p in $procs) {
    $report.Add([pscustomobject]@{
        Check = 'Process'; Indicator = $p.Name
        Detail = "PID $($p.Id) | $($p.Path)"; Host = $env:COMPUTERNAME
    })
}

# 3. Common UltraViewer install paths
$paths = @(
    "$env:ProgramFiles\UltraViewer",
    "${env:ProgramFiles(x86)}\UltraViewer",
    "$env:LOCALAPPDATA\UltraViewer",
    "$env:APPDATA\UltraViewer"
)
foreach ($path in $paths) {
    if (Test-Path $path) {
        $report.Add([pscustomobject]@{
            Check = 'FilePath'; Indicator = $path
            Detail = 'UltraViewer installation directory present'; Host = $env:COMPUTERNAME
        })
    }
}

# 4. Run-key autostart entries
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($rk in $runKeys) {
    $props = Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue
    if ($props) {
        $props.PSObject.Properties | Where-Object { $_.Value -like '*UltraViewer*' } | ForEach-Object {
            $report.Add([pscustomobject]@{
                Check = 'Autostart'; Indicator = "$rk\$($_.Name)"
                Detail = $_.Value; Host = $env:COMPUTERNAME
            })
        }
    }
}

# 5. DNS cache hits for Hotejka/ROI777 TDS domains
$tdsDomains = @('roi777.com','roi-traffic.icu','hotejka.ink','hotejka.com','hotcname.help','lib1.biz','fosetya.shop','goalods.lol')
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $tdsDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    foreach ($h in $hits) {
        $report.Add([pscustomobject]@{
            Check = 'DNSCache'; Indicator = $h.Entry
            Detail = "Resolved to $($h.Data) - TDS infrastructure contact"; Host = $env:COMPUTERNAME
        })
    }
}

# 6. Established outbound connections from UltraViewer processes
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { ($_.OwningProcess | ForEach-Object { (Get-Process -Id $_ -ErrorAction SilentlyContinue).Name }) -like '*UltraViewer*' }
foreach ($c in $conns) {
    $report.Add([pscustomobject]@{
        Check = 'NetConn'; Indicator = "PID $($c.OwningProcess)"
        Detail = "$($c.RemoteAddress):$($c.RemotePort)"; Host = $env:COMPUTERNAME
    })
}

if ($report.Count -gt 0) {
    Write-Host "[!] $($report.Count) indicator(s) found on $env:COMPUTERNAME" -ForegroundColor Red
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\hotejka_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
} else {
    Write-Host "[+] No Hotejka/UltraViewer indicators found on $env:COMPUTERNAME" -ForegroundColor Green
}