Grandoreiro STUN/WebRTC C2 Tunnel from Non-Browser Process (UDP 3478)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects anomalous network traffic patterns characteristic of the Grandoreiro banking trojan, which tunnels Command and Control (C2) communications over STUN/WebRTC (UDP port 3478). The rule identifies processes that are not known web browsers or conferencing applications initiating these STUN connections, a technique used by the malware to blend with legitimate collaboration traffic.