Kimsuky NUKESPED C2 Beaconing via Fastly CDN (AS54113) Infrastructure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects command-and-control (C2) communication patterns associated with the Kimsuky threat group (specifically NUKESPED malware). It identifies network traffic to specific Fastly CDN IP addresses or domains related to the National Health Insurance Service (nhis.or.kr) originating from known malicious or suspicious execution processes like wscript.exe, cscript.exe, powershell.exe, or zlrenu8.exe.