Contagious Interview Malware Tor C2 Communication

Georg Lauenstein@gsec

•updated Nov 14, 2025•4•0•78

Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.