NUKESPED zlrenu8.exe Outbound HTTP Exfiltration to Fastly CDN

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.