Custom backdoor ICMP check-in with embedded bot ID (32-byte echo request, non-standard payload)

Duo Tech@duotech

•updated Aug 17, 2026•0•0•1

Detects a 32-byte ICMP echo request carrying the backdoor's 8-byte bot ID, explicitly excluding the standard Windows ping.exe payload pattern (the dominant legitimate traffic at this size) and rate-limited to reduce alert volume.