Reconnaissance Data Exfil via HTTP POST to dynv6-Hosted C2 (finalservice.php)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•4•0•3

Detects outbound HTTP POST requests to dynv6 dynamic DNS providers containing specific multipart form data patterns, including filenames like 'Info.txt', indicative of data exfiltration by the Kimsuky threat group using custom C2 staging scripts.