Sauron Loader RSA-encrypted C2 beacon to embedded config domains

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.