SilverFox relays.json discovery fetch with ms-timestamp cache-buster

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•0

Detects network activity related to the SilverFox modular malware framework, including relay/dispatcher discovery, contact with known C2 infrastructure (noah-ssh.com.cn and Cloudflare Workers), and specific HTTP response patterns associated with its relay discovery process.