Lorem Ipsum Dead-Drop C2 Resolution via ProgramData Process

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•0•0•40

Detects network connections from non-browser processes executing from the ProgramData directory to known dead-drop resolver forums (digitalpoint.com, letsdiskuss.com) used by Lorem Ipsum for C2 resolution. This rule specifically targets the Rapid Brigantine threat.