DEV#POPPER RAT (Void Dokkaebi) C2 Traffic via verify-human/u-f Endpoints

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•7

Detects command-and-control network traffic associated with the DEV#POPPER (Void Dokkaebi/Contagious Interview) RAT. The rule monitors for characteristic WebSocket heartbeat and notification calls to '/verify-human/' endpoints, data exfiltration requests to '/u/f', and outbound connections to known malicious C2 IP addresses.