CornFlake RAT sync.dat Retrieval via Custom JSON C2 Protocol

Duo Tech@duotech

•updated Aug 5, 2026•0•0•3

Detects HTTP GET requests for sync.dat runtime configuration files with a JSON accept header, consistent with CornFlake RAT's custom C2 protocol, excluding known legitimate cloud-sync/update CDN hosts.