Kimwolf Bot Connects to Local SOCKS5 Proxy on Loopback Port 23075
Detects network connections to the localhost IP 127.0.0.1 on TCP port 23075 initiated by non-browser and non-VPN processes, excluding standard system binaries and protected paths. This pattern is commonly associated with SOCKS proxies, tunnelers, or malicious local communication channels used for C2 redirection.
Cortex XDR
