TOKYOCORE Ransomware Discord Webhook C2/Exfil POST

Duo Tech@duotech

•updated Jul 27, 2026•0•0•3

Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.