HEAVYGRAM/CHOSEN BRICK Possible Data Exfiltration to HEAVYGRAM Vultr S3 Bucket - ams1 region
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Suricata
