YuanKong Android RAT + Hotejka Help TDS: OTX Pulse Analysis — Multi-Tenant Mobile RAT & Tech Support Scam Infrastructure Detection Pack

Two live pulses from AlienVault OTX this cycle expose a pair of operationally distinct but equally actionable threat ecosystems: a multi-tenant Android remote access trojan (YuanKong) running a malware-as-a-service model, and Hotejka's Help Traffic Distribution System (TDS), a Russian-language affiliate operation delivering tech support scams at scale since April 2017.

YuanKong represents a mature mobile RAT commercialization model. Star Labs researchers found that every operator build is stamped with the operator's identity — hardcoded account IDs, operator handles, and enrollment codes embedded as string constants in each sample. The dropper stores decryption keys in cleartext configuration files, uses a two-key XOR unpacking scheme, and signs all payloads with a shared certificate across operator builds. This is effectively a franchised surveillance platform: one core codebase, many criminal tenants, and a supply of attribution material baked directly into the malware itself. Delivery combines overlay attacks (credential/UI capture over legitimate apps) with ADB privilege escalation, indicating targets are compromised via sideloaded droppers or abused developer-mode access.

Help TDS (Hotejka), tracked by Infoblox and believed to be a rebrand of the ROI777 affiliate program, is a nine-year-old traffic monetization machine. Victims in the United States, Australia, Belgium, Canada, France, Japan, and Sweden are routed through compromised websites, malvertising, social media lures, and spam into fake Microsoft security alerts that lock the browser. Browser fingerprinting and geolocation filtering ensure only monetizable victims reach the scam landing pages. The endgame frequently involves social-engineering victims into installing legitimate remote access tooling — UltraViewer — giving operators direct hands-on-keyboard access to victim machines. The operators have also begun abusing Cloudflare Pages to host scam infrastructure, borrowing Cloudflare's reputation to evade blocklists.

Collectively, these pulses show two sides of modern criminal infrastructure: franchised mobile surveillance tooling and industrialized web traffic monetization — both dependent on identifiable, blockable C2 and TDS domains.

Threat Actor / Malware Profile

YuanKong (Android RAT — Multi-Tenant MaaS)

• Distribution: Sideloaded droppers; infection chains leverage overlay attack frameworks and ADB-based privilege escalation, suggesting distribution via third-party app stores, phishing APKs, or physical/remote ADB abuse.
• Payload behavior: Full remote access trojan functionality — remote control service capable of device manipulation, overlay injection for credential capture, and persistent operator access.
• Unpacking: Two-key XOR decryption scheme; keys stored in cleartext configuration files inside the dropper — a significant OPSEC failure enabling payload extraction and cross-build correlation.
• Attribution markers: Each build embeds operator account IDs, handles, and enrollment codes as hardcoded strings. All operator builds share a single signing certificate, allowing certificate-based clustering of the entire tenant ecosystem.
• C2 infrastructure: Hostnames include www.ktxapp.com, www.ktx123.net, and domain ktx123.net — typosquat-styled branding consistent with Android-targeting scams.

Hotejka / Help TDS (ROI777 Rebrand)

• Actor: Russian-language affiliate program, active since April 2017; assessed as a rebrand of ROI777 (roi777.com).
• Distribution: Compromised websites, malvertising, social media, and spam feeding a Traffic Distribution System that performs browser fingerprinting + geolocation gating before redirecting to scam content.
• Payload behavior: Fake Microsoft security alerts that lock the browser (browser-locker technique), pressuring victims to call fraudulent support numbers. Callers are socially engineered into installing UltraViewer for direct remote access.
• Infrastructure abuse: Heavy use of Cloudflare Pages for hosting scam landing pages, plus rotating TDS domains (hotejka.ink, hotejka.com, hotcname.help, lib1.biz, fosetya.shop, goalods.lol, roi-traffic.icu).
• Anti-analysis: Geolocation and fingerprint filtering actively evade sandboxes and researchers — non-target environments receive benign redirects.
• Objective: Affiliate-driven tech support scam monetization with hands-on-keyboard follow-on access for financial theft and potential data exfiltration.

IOC Analysis

The indicator set breaks into two operational buckets:

YuanKong (file hashes + C2 hostnames):

• 6 file hashes (5 SHA256, 1 MD5) representing dropper and payload samples across operator builds. Load SHA256 values into EDR blocklists and retro-hunt downloads/email gateways. The shared signing certificate (per Star Labs) is a stronger pivot than hashes alone — hunt your mobile device management (MDM) telemetry for sideloaded APKs signed by common certificates.
• Hostnames www.ktxapp.com and www.ktx123.net plus apex ktx123.net should be sinkholed at DNS resolvers and added to proxy blocklists. Mobile devices rarely traverse enterprise DNS, so pair this with MDM/MTD alerting and guest-WiFi resolver controls.

Help TDS / Hotejka (TDS and scam domains):

• 8 domains forming the TDS redirect chain and affiliate infrastructure. These rotate — treat them as seeds for predictive detection (Infoblox's approach): monitor for newly registered domains matching Hotejka naming patterns, lookalike TLDs (.icu, .lol, .shop, .ink, .help), and Cloudflare Pages subdomains serving Microsoft-branded alert pages.

Operationalization guidance:

• Feed domains into DNS firewall / RPZ zones and secure web gateway URL categories immediately.
• Hash IOCs go to EDR (block + retroactive scan), email security (attachment detonation verdicts), and network sandbox watchlists.
• Tooling: AlienVault OTX pulses ingest natively into most SIEMs via API; use CyberChef or custom scripts for YuanKong's two-key XOR extraction, and apktool/jadx for static analysis of samples matching the SHA256 set. Infoblox's predictive DNS threat intelligence can preempt Hotejka domain rotation.

Detection Engineering

The following detections target: (1) YuanKong C2 resolution, (2) Help TDS / Hotejka domain resolution, and (3) unauthorized UltraViewer installation — the hands-on-keyboard payload of the tech support scam chain.

---
title: YuanKong Android RAT C2 Domain Resolution
id: 8f2a1c44-7b3d-4e9a-b1f2-yuankong0001
status: experimental
description: Detects DNS resolution of known YuanKong Android RAT command-and-control hostnames. YuanKong is a multi-tenant Android RAT using two-key XOR unpacking and shared signing certificates across operator builds.
author: Security Arsenal Threat Intelligence
references:
  - https://starlabs.sg/blog/2026/10-yuankong-rat-the-android-remote-control-service-that-stamps-its-operators-names-into-every-build
date: 2026/11/15
modified: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: dns
selection:
  query|contains:
    - 'ktxapp.com'
    - 'ktx123.net'
condition: selection
falsepositives:
  - Threat intelligence sandbox detonation of YuanKong samples
level: high
---
title: Hotejka Help TDS Infrastructure Domain Resolution
id: 3d7b9e21-5c1a-4f8d-a2e4-hotejka0002
status: experimental
description: Detects DNS queries to Hotejka / Help TDS (ROI777 rebrand) traffic distribution and tech support scam infrastructure. Operation routes victims via fingerprinted redirects to fake Microsoft security alerts and UltraViewer social engineering.
author: Security Arsenal Threat Intelligence
references:
  - https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/
date: 2026/11/15
modified: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1566
logsource:
  category: dns
selection:
  query|contains:
    - 'roi777.com'
    - 'roi-traffic.icu'
    - 'hotejka.ink'
    - 'hotejka.com'
    - 'hotcname.help'
    - 'lib1.biz'
    - 'fosetya.shop'
    - 'goalods.lol'
condition: selection
falsepositives:
  - Security research or sandbox analysis of Help TDS campaigns
level: high
---
title: UltraViewer Remote Access Tool Execution - Tech Support Scam Vector
id: 6a1c4d88-2e9f-4b7c-c3d5-ultravwr003
status: experimental
description: Detects execution or installation of UltraViewer, a legitimate remote access tool abused by Hotejka Help TDS tech support scam operators for hands-on-keyboard access to victim machines. Flag any execution outside an approved IT support context.
author: Security Arsenal Threat Intelligence
references:
  - https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/
date: 2026/11/15
modified: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
selection_img:
  Image|endswith:
    - '\UltraViewer.exe'
    - '\UltraViewer_Desktop.exe'
  OriginalFileName|contains: 'UltraViewer'
selection_setup:
  CommandLine|contains:
    - 'UltraViewer_setup'
    - 'UltraViewer'
  ParentImage|endswith:
    - '\msiexec.exe'
    - '\explorer.exe'
condition: 1 of selection_*
falsepositives:
  - Approved internal IT helpdesk use of UltraViewer (maintain an allowlist of authorized support hosts)
level: medium

// Security Arsenal - YuanKong RAT & Hotejka Help TDS Hunt
// Correlates DNS resolution of C2/TDS infrastructure with suspicious remote access tool execution
let YuanKongIOC = dynamic(["ktxapp.com", "www.ktxapp.com", "ktx123.net", "www.ktx123.net"]);
let HotejkaIOC = dynamic(["roi777.com", "roi-traffic.icu", "hotejka.ink", "hotejka.com", "hotcname.help", "lib1.biz", "fosetya.shop", "goalods.lol"]);
let DnsHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (YuanKongIOC) or RemoteUrl has_any (HotejkaIOC)
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend IOCType = iff(RemoteUrl has_any (YuanKongIOC), "YuanKong-RAT-C2", "Hotejka-HelpTDS");
let UltraViewerExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName has "UltraViewer" or ProcessCommandLine has "UltraViewer"
    | project UltraViewerTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
DnsHits
| union (UltraViewerExec | project TimeGenerated=UltraViewerTime, DeviceName, IOCType="UltraViewer-RMM-Execution", FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc

# Security Arsenal - YuanKong / Help TDS Endpoint Hunt Script
# Checks DNS cache for TDS/C2 hits, UltraViewer installation artifacts, and suspicious outbound connections

$tdsDomains = @("roi777.com","roi-traffic.icu","hotejka.ink","hotejka.com","hotcname.help","lib1.biz","fosetya.shop","goalods.lol")
$yuankongDomains = @("ktxapp.com","ktx123.net")

Write-Host "[*] Checking DNS client cache for Hotejka TDS / YuanKong C2 resolution..." -ForegroundColor Cyan
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $entry = $_.Entry
    ($tdsDomains + $yuankongDomains | Where-Object { $entry -like "*$_*" }).Count -gt 0
}
if ($dnsHits) {
    Write-Host "[!] ALERT: DNS cache contains TDS/C2 entries:" -ForegroundColor Red
    $dnsHits | Format-Table Entry, Name, Data -AutoSize
} else {
    Write-Host "[+] No TDS/C2 domains found in DNS cache." -ForegroundColor Green
}

Write-Host "[*] Checking for UltraViewer installation artifacts..." -ForegroundColor Cyan
$uvPaths = @("$env:ProgramFiles\UltraViewer", "${env:ProgramFiles(x86)}\UltraViewer", "$env:LOCALAPPDATA\UltraViewer")
foreach ($p in $uvPaths) {
    if (Test-Path $p) {
        Write-Host "[!] ALERT: UltraViewer directory found: $p" -ForegroundColor Red
        Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, CreationTime, LastWriteTime | Format-Table -AutoSize
    }
}
$uvSvc = Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*UltraViewer*" -or $_.Name -like "*UltraViewer*" }
if ($uvSvc) {
    Write-Host "[!] ALERT: UltraViewer service present:" -ForegroundColor Red
    $uvSvc | Format-Table Name, DisplayName, Status, StartType -AutoSize
}

Write-Host "[*] Checking active connections for UltraViewer processes and RMM ports..." -ForegroundColor Cyan
$uvProc = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -like "*UltraViewer*" }
if ($uvProc) {
    Write-Host "[!] ALERT: UltraViewer process running (PID: $($uvProc.Id))" -ForegroundColor Red
    Get-NetTCPConnection -OwningProcess $uvProc.Id -ErrorAction SilentlyContinue |
        Where-Object { $_.State -eq "Established" } |
        Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State -AutoSize
}

Write-Host "[*] Checking installed programs registry for UltraViewer..." -ForegroundColor Cyan
$uninstallKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*","HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*")
$uvReg = Get-ItemProperty $uninstallKeys -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*UltraViewer*" }
if ($uvReg) {
    Write-Host "[!] ALERT: UltraViewer registered as installed:" -ForegroundColor Red
    $uvReg | Select-Object DisplayName, DisplayVersion, InstallDate, InstallLocation | Format-List
} else {
    Write-Host "[+] No UltraViewer registry install entries found." -ForegroundColor Green
}

Write-Host "[*] Hunt complete. Correlate any hits with proxy logs and the OTX pulse IOCs." -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours)

• Block all 16 indicators across DNS resolver/RPZ, secure web gateway, and EDR hash blocklists. Prioritize the Hotejka TDS domains — any internal resolution indicates an active scam redirect chain reaching your users.
• Run the KQL hunt and PowerShell script across the fleet. Any UltraViewer installation not on the approved IT support allowlist is an incident — assume hands-on-keyboard access occurred.
• Review MDM/MTD telemetry for sideloaded APKs; flag any Android devices with ADB debugging enabled or unknown-source installs matching YuanKong hash IOCs.

24 Hours

• If UltraViewer was executed by an end user: treat as a compromised endpoint and identity. Force credential resets for that user's accounts, revoke sessions/tokens, and review financial-application and email access during the access window — scam operators frequently harvest banking sessions and set up mail forwarding rules.
• For YuanKong: any mobile device matching C2 resolution or hash IOCs should be isolated, imaged where possible, and the user's mobile-accessible credentials (email, SSO, banking, authenticator seeds) rotated. Check for overlay-captured credentials.
• Pull web proxy logs for the 30 days preceding first IOC resolution to map the full redirect chain (malvertising source, compromised site, landing page) — this identifies the lure entry point.

1 Week

• RMM governance: implement application control (WDAC/AppLocker) restricting remote access tools to an approved allowlist. UltraViewer, AnyDesk, TeamViewer, and similar tools should never execute outside sanctioned IT workflows — this single control breaks the entire tech support scam kill chain.
• Browser-locker resilience: deploy browser isolation or DNS-layer blocking of newly registered domains; Hotejka rotates disposable TLDs (.icu, .lol, .shop) faster than static lists can track. Subscribe to predictive DNS intelligence feeds.
• Mobile hardening: enforce MDM policy blocking unknown-source installs and ADB debugging on corporate or BYOD-enrolled devices; deploy MTD with certificate-based detection for YuanKong's shared signing certificate.
• User awareness: brief staff on the fake-Microsoft-alert playbook — legitimate Microsoft never displays phone numbers in browser pop-ups. Emphasize the "support agent asked me to install software" red flag.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub