Environmental keying: public IP lookup followed by same-process secondary-stage payload fetch
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
Cortex XDR
