Kimsuky NUKESPED WinHTTP C2 Beaconing - Non-Browser WINHTTP.dll + HTTPS

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where a process, other than standard browsers or common system applications, loads 'WINHTTP.dll' and subsequently initiates outbound HTTPS connections. This behavior is often indicative of custom malware or specialized tooling, such as the NUKESPED/Kimsuky framework, using direct API calls for command and control (C2) communication to bypass standard application-based network filtering.