Grandoreiro C2: STUN/WebRTC or Google Cloud Pub/Sub and Azure MQTT from Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects network connections to specific cloud service providers (Google Cloud PubSub/MQTT, Azure Service Bus) or common STUN/WebRTC ports (3478) initiated by processes other than standard web browsers or common communication applications.