PhantomRaven C2 Infrastructure Communication

Elgonad .@elgonad

•updated May 5, 2026•1•0•475

Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.