Miku Campaign: Chisel reverse-tunnel beacon to Miku actor VPS (SOCKS/bind-shell channel)

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•1

Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.