SNOWLIGHT/VSHELL AVX-512 Encrypted C2 to 38.60.253.35 via WebSocket port 8084

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.