OnyxC2 backend API sync beacon with hwid/ownertoken parameters

Duo Tech@duotech

•updated Aug 14, 2026•0•0•4

Detects HTTP requests to the OnyxC2 backend API sync endpoint (akmuniverstall.top) carrying the characteristic hwid, ownertoken, and botversion=3.0 parameters used for device-fingerprint C2 check-ins.