MovieReaper File Manager Module C2 Exfiltration via Masqueraded msedge.exe

Ibrahim Saud@tektrix

•updated 22 days ago•1•0•2

Detects network communication to known MovieReaper C2 infrastructure (deadhub.org or 193.23.118.155) originating from a masqueraded 'msedge.exe' process located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicating potential C2 check-ins or data exfiltration by the file manager module.