Lorem Ipsum C2 Infrastructure Beaconing

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•13•1•221

Detects network connections resolving to specific domains or UUID-based API endpoints used by Lorem Ipsum's primary C2 cluster following the late-May ClickFix pivot. This rule identifies known command and control (C2) infrastructure by matching specific domain names and a UUID-based API endpoint pattern in network connection URLs.