VSHELL RAT credential and file harvesting exfiltration to 38.60.253.35

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.