VelvetCake Raw TCP C2 Authentication (PASSWORD/GET qqq)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•6

Detects network communication associated with VelvetCake C2 infrastructure, including plaintext authentication, specific inventory request commands, and session termination commands over port 12345.