Storm-2561 Network IOC Detection

Lacey Cochrane@NullVectorX

•updated Mar 16, 2026•7•0•102

Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.