VSHELL RAT WebSocket C2 on Port 8084 from Suspicious Process Paths

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects outbound network connections to port 8084 initiated by processes originating from suspicious directories such as AppData, Temp, or ProgramData. This behavior is indicative of VSHELL RAT leveraging WebSocket-based C2 communication, a technique observed in UNC5221 SNOWLIGHT campaigns.