CRPx0 Authenticated C2 Beacon via relay.php Bearer Token

Ibrahim Saud@tektrix

•updated Sep 14, 2026•1•0•2

Detects HTTP POST requests directed at 'relay.php' that contain a hardcoded Authorization Bearer token ('crpx0_c2_2026') used by the CRPx0 ransomware. This activity indicates a compromised host is actively beaconing to C2 infrastructure for command execution, key exchange, or data exfiltration.