DcRAT libjpeg-turbo Compression and Exfiltration to kkxqbh.top (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.