APT36 Ghazwa GPSSERV Continuous GPS Exfiltration via TCP Port 18585

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.