Yandex Cloud Function C2 Activity

Ethan Andrews@eandrews

•updated Feb 26, 2026•13•0•166

Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.