SNOWGLAZE WebSocket tunnel to Heroku C2 with login/password/uuid auth payload

Duo Tech@duotech

•updated Aug 5, 2026•2•0•2

Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.