APT28 filen.io C2 Channel via Non-Browser Process Network Connection

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects network connections to Filen.io cloud storage initiated by processes other than common web browsers. This behavior is often associated with the use of command-line tools or scripts for unauthorized file exfiltration or data staging.