Koktevrat DGA-generated C2 domain contact (.icu/.cfd)

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.