VSHELL RAT C2 Beacon via WebSocket Port 8084 CDN Domain Blending

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects anomalous outbound TCP network connections on port 8084 originating from non-browser processes to known CDN providers (Akamai, Microsoft). This behavior is characteristic of VSHELL RAT C2 beaconing using domain blending techniques to mask communications within expected network noise.