WebRTC signaling response forces C2 through Twilio TURN relay

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•3

This rule detects network traffic patterns associated with the msaRAT remote access trojan (RAT) as it initializes WebRTC communication. It identifies the initial POST request to a token service and the subsequent response containing Twilio TURN and Google STUN relay server configurations, which are used by the malware to establish peer-to-peer tunnels for command-and-control communication.