StopAndProtect SilentDataCollector encrypted archive exfiltration to WordPress C2

Duo Tech@duotech

•updated Aug 18, 2026•0•0•0

Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.