Silent Rotor - JSON Exfiltration to Kleymarket (T1041)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Detects the Silent Rotor malware transmitting collected system profile as a serialized JSON blob to the C2 domain cdn.kleymarket.ru. The detection specifically looks for network connections to this domain initiated by a process named 'Подтверждение заказа продукции ЦАИ.exe'.