Network Connection Initiated To Mega.nz

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•0•0•0

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.