QUICAgent C2: QUIC UDP/443 with self-signed 'RAT CA' certificate

Ibrahim Saud@tektrix

•updated 14 days ago•0•0•1

Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.