Kimsuky NUKESPED C2 Beacon to Fastly CDN from ProgramData or Temp Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects outbound network connections to Fastly CDN IP ranges originating from suspicious file paths (Temp or ProgramData) or common LOLBins (wscript.exe, powershell.exe) often utilized by the Kimsuky threat group for NUKESPED backdoor C2 communication.