DcRAT C2 Exfiltration to kkxqbh.top (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•2•0•4

Detects network communication associated with DcRAT, specifically identifying DNS lookups for the known C2 domain kkxqbh.top or network connections to port 2671 originating from suspicious or specific host processes.