LegionLoader Python C2 via _socket.pyd from Traiolx Custom Utils

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.