TLS connection to Sapphire Sleet Hostwinds C2 infrastructure with matching cert issuer (Mastra/axios overlap)

Duo Tech@duotech

•updated Aug 21, 2026•0•0•0

Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.