DOUBLECUP session polling/telemetry beacon to C2 infrastructure

Duo Tech@duotech

•updated Aug 4, 2026•2•0•1

Detects DOUBLECUP's session polling/telemetry beacon to /session/reg, /session/check, and /session/signal with a sid= query parameter, requiring at least 5 requests within 15 seconds to match the malware's 1.2-3 second polling cadence.