PhantomPulse Staging Server Comm
Detects network connections to the primary staging server IP address (195.3.222.251) used to host the intermediate PowerShell script and the PhantomPull loader associated with the REF6598 campaign and the PhantomPulse RAT.
Sigma
