APT36 Warcode Loader Execution from Public Directories

Georg Lauenstein@gsec

•updated Mar 16, 2026•1•0•49

Detects execution of Warcode Crystal-based shellcode loader from common writable public directories used by APT36