NJRAT beaconing to AWS-hosted C2 infrastructure (GTA6 lure campaign)

Arnold Chan@slaz

•updated Sep 14, 2026•0•0•1

Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.