TF-2012147
high
📛 Threat Title
KongTuke: Domain name that delivers a malware payload azvvedo.lol
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-11-03 00:09:04 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
azvvedo.lol
IOC database
- Type
- domain
- Value
azvvedo.lol- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Domain name that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-11-03 00:09:04 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (10)
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as KongTuke .
-
web:malpedia.caad.fkie.fraunhofer.de
Kongtuke is a sophisticated TDS system that was initially discovered around May 2024. Making use of compromised CMS Websites, Kongtuke redirects website visitors through a multi-stage infection process ultimately leading to device infection. Initially using fake Update lures, it started to use FakeCaptcha lures at the beginning of 2025. It is likely an initial access service, selling ...
-
web:packetwatch.com
The malicious script grabs a payload from a malicious domain . In all cases Team Sixty43 has seen in this recent spike in KongTuke activity, the payload is a tar file - a Havoc C2 demon (C2 implant).
-
web:redcanary.com
A malicious traffic distribution system, KongTuke uses compromised WordPress sites to deliver ever-evolving lures to unsuspecting users.
-
web:reliaquest.com
Threat actors are impersonating help-desk staff over external Microsoft Teams chats to trick victims into deploying "ModeloRAT" on their own machines. ReliaQuest attributes the activity to financially motivated initial access broker (IAB) " KongTuke " based on reuse of the group's custom Python loader. Previously, KongTuke has compromised WordPress sites to host "ClickFix" and "CrashFix" lures ...
-
web:threatfox.abuse.ch
KongTuke IOC: https://azevedo.lol/api/v1/status (url)
-
web:threatfox.abuse.ch
KongTuke IOC: azevedo.lol ( domain ) You are viewing the ThreatFox database entry for domain azevedo.lol.
-
web:www.levelblue.com
The KongTuke alias is derived from one of the domain names observed hosting malicious FAKEUPDATES JavaScript payloads . This variant consistently leverages the URL endpoints "/land.php" and "/update.php" within the malware's source code.
-
web:www.malware-traffic-analysis.net
This exercise provides 3 things: A packet capture (pcap) from the infected Windows host. Text files with the HTTPS traffic to the Kongtuke domain and the ClickFix script from the fake verification page. Malware files and artifacts that I retrieved from the infected Windows host. We only need the pcap for this exercise.
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.