SPECTRALVIPER Cookie-Based HTTP C2 Beaconing to OceanLotus Infrastructure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects network beaconing activity associated with the SPECTRALVIPER C2 framework. This rule identifies outbound HTTP GET requests targeting known C2 infrastructure domains and IP addresses, while correlating the traffic with specific browser user agents and cookie patterns indicative of this actor.