#ParsedReport #CompletenessHigh
23-09-2026

[Op Report\] KongTuke ClickFix to SystemBC: HoK Intrusion

https://blog.deception.pro/blog/kongtuke-systembc-sep-2026

Report completeness: High

Actors/Campaigns:
Fin12
Alpha_spider
Vice_society

Threats:
Kongtuke
Clickfix_technique
Systembc
Etherhiding_technique
Passthehash_technique
Minidump_tool
Mimikatz_tool
Rottenpotato_tool
Impacket_tool
Crackmapexec_tool
Chisel_tool
Adaptixc2_tool
Mintsloader
Etherrat
Winos
Cloudflared_tool
Nltest_tool
Goldenpac_tool
Conti
Trickbot
Ryuk
Cobalt_strike_tool
Empire_loader
Zeppelin
Avaddon
Lolbin_technique
Bitsadmin_tool

Victims:
Insurance

Geo:
Russia

TTPs:
Tactics: 4
Technics: 4

IOCs:
Url: 10
Domain: 13
File: 22
IP: 13
Coin: 1
Hash: 5
Command: 3
Email: 1

Soft:
WordPress, Node.js, curl, Cloudflare, Active Directory, Embarcadero, Linux, ESXi, Kitty, trycloudflare, have more...

Crypto:
ethereum

Algorithms:
zip, sha256

Languages:
powershell