Sapphire Sleet C2 Network Activity

Josh M.@jmadson

•updated Apr 2, 2026•1•1•86

Detects network connections to a known Sapphire Sleet (APT38) command and control (C2) IP address and port, or DNS resolution requests for a malicious Sapphire Sleet C2 domain. This rule identifies direct communication with infrastructure associated with the Sapphire Sleet threat actor.