MALWARE DPRK Contagious Interview JSON Storage Malware Delivery
This rule detects network traffic to specific JSON storage services (jsonkeeper.com, jsonsilo.com, npoint.io) that have been observed to be abused by the DPRK-linked 'Contagious Interview' threat actors for malware delivery. The detection is based on TLS Server Name Indication (SNI) patterns.
Suricata
