Sauron Loader chunked screenshot exfiltration burst via rnpkeys.exe

Ibrahim Saud@tektrix

•updated 10 days ago•0•0•1

Detects anomalous, high-frequency outbound HTTPS POST requests from the 'rnpkeys.exe' process, characteristic of the Sauron Loader exfiltrating screenshot chunks (Message Type 3) to a Command and Control (C2) server.