RomulusLoader C2 Network Activity via Vulkan Binary
Detects network connections originating from the Vulkan loader executable (`vulkaninfo.exe`) over port 1234. This behavior is indicative of TA4922 utilizing RomulusLoader to establish command and control communications and retrieve secondary payloads, such as RMM tools.
Sigma
