SNOWLIGHT/VSHELL C2 Exfiltration to 38.60.253.35 on Port 8084

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.