Apt28 Cloud Storage C2

nomit vyas@xoxo

•updated Feb 8, 2026•2•0•28

Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.