Detection of BoryptGrab-Lineage Infostealer Activity via Fake GitHub Delivery, C2 Traffic, and DLL Side-Loading

Syed Usfar Wasim@nCD24

•updated Jul 16, 2026•6•2•19

Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.