Sapphire Sleet - C2 Communication to 23.254.164.92

Georg Lauenstein@gsec

•updated Jun 24, 2026•0•0•8

Detects network communication to the Sapphire Sleet C2 server used in the easy-day-js npm supply chain compromise. The dropper contacts 23.254.164.92:8000 to download second-stage payloads after disabling TLS certificate verification.