lambsys C2 Beaconing to 83.142.209.214 via POST /status.php and /setup_status.php

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•4

Detects periodic beaconing behavior associated with a Lambsys Go-based implant communicating with a specific C2 IP address (83.142.209.214) over HTTP. The rule identifies POST requests to specific paths ('/status.php' or '/setup_status.php') using the 'Go-http-client/1.1' User-Agent, with evidence of repeated connection attempts.