VILE Ransomware Exfiltration to Gofile Infrastructure via Go HTTP/2 Stack

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.