VectraRAT C2 beaconing over MessagePack-over-TCP protocol on port 3308

Arnold Chan@slaz

•updated Sep 14, 2026•0•0•1

Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.