APT28 CovenantGrunt C2 Communication to filen.io Cloud Storage

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects network connections from internal endpoints to Filen.io cloud storage domains and subdomains. The rule specifically flags interactions involving common API endpoints for file operations (upload, download, directory listing) as 'Critical' risk, while generic traffic to the domain is classified as 'High' risk.