TuglaInsaatci Stego Loader: payload.bin + Optimax.dll Drop from Bitmap SR1 Extraction

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the steganographic payload extraction chain associated with the TuglaInsaatci .NET loader. The rule monitors for the sequential creation of 'payload.bin' (reconstructed from bitmap data) followed by the creation of 'Optimax.dll' on the same host, which is characteristic of the FortiBleed campaign's loader-as-a-service delivery methodology.