Grandoreiro STUN/TURN UDP C2 via Non-Browser Process on Port 3478

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.