OnyxC2 multi-channel RAT: HTTP reverse shell beaconing, SOCKS5 proxy, or TOR-like traffic from non-browser process

Duo Tech@duotech

•updated Aug 14, 2026•1•0•4

Detects sustained HTTP reverse-shell beaconing, SOCKS5 proxy handshake patterns, or TOR-like traffic on TOR guard/entry ports, originating from a non-browser process, consistent with OnyxC2's multi-channel remote-access toolkit.