Konni/Kimsuky VelvetCake C2 Beacon via OKey/Who/Areyou=cake URL Pattern

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•3

Detects HTTP traffic patterns associated with the VelvetCake malware used by North Korean threat actors Konni and Kimsuky. These signatures identify beaconing behavior to known free-hosting infrastructure, specifically monitoring for unique URL parameters ('OKey=', 'Who=', 'Areyou=cake') and common file naming conventions associated with the C2 communication.