LeakyStealer C2 Communication

Georg Lauenstein@gsec

•updated Nov 9, 2025•5•0•93

Detects outbound HTTP POST requests to the LeakyStealer C2 server 'everstead.group' using a specific user-agent and URI paths.