TELEPUZ Dead-Drop Resolver - Steam Community Profile C2 Lookup

Duo Tech@duotech

•updated Jul 20, 2026•1•0•3

This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.