Shared parent-domain infra linking SpiceRAT/NodeEdgeRAT/NomadRAT

Ankit Mehta@Secvyn

•updated Sep 17, 2026•1•0•3

This rule monitors for DNS queries and network traffic directed toward specific domains and subdomains identified as associated with the SpiceRAT, NodeEdgeRAT, and NomadRAT malware infrastructure. It correlates data from DNS events and general security/network logs to detect potential command and control (C2) communication patterns, regardless of specific source IP overlap.