CrashStealer exfiltration to hardcoded C2 IP 179.43.166.242

Duo Tech@duotech

•updated Jul 14, 2026•1•0•6

This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.