SparroWocky C2 traffic to known FamousSparrow IP addresses

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.