SynkLoader ChaCha20 C2 beacon to hardcoded domains via HTTPS

Emiliano Mema@Nosalva

•updated Aug 25, 2026•1•0•2

Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.