PicassoLoader C2 Fingerprint URI Detection

Brandon Rodriguez@BMRodriguez

•updated May 22, 2026•3•0•82

Detects network connections to the URI path '/employment/documents-and-resources', which is used by FrostyNeighbor's PicassoLoader to exfiltrate host fingerprinting data and assess compromised hosts for further payload delivery.