Bumblebee/Akira Intrusion: Reverse SSH Tunnel for RDP Exposure to 193.242.184.150

Duo Tech@duotech

•updated Jun 29, 2026•0•0•1

This rule detects outbound network traffic from internal hosts to a known malicious IP address (193.242.184.150) over port 22 (SSH). This behavior is indicative of a reverse SSH tunnel established for C2 communication and the potential exposure of internal RDP services to the attacker.