NUKESPED C2 via Fastly CDN: zlrenu8.exe Connecting to AS54113 IPs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects suspicious outbound network connections to specific Fastly CDN IP addresses associated with the Kimsuky threat group's NUKESPED backdoor. The rule identifies processes attempting to communicate with these infrastructure IPs that are not part of a predefined list of trusted or common legitimate applications, indicating potential command and control (C2) activity.