Kimsuky recon data exfil via HTTP POST to dynv6 C2 finalservice.php

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

This rule detects outbound HTTP POST requests to dynv6-hosted infrastructure, specifically targeting communication patterns associated with Kimsuky campaigns. It monitors for exfiltration indicators such as the 'finalservice.php' endpoint, specific multipart form boundaries, and file indicators like 'Info.txt' used for data exfiltration.