Grandoreiro C2 via STUN/WebRTC and MQTT from Non-Browser Processes

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•10

Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.