Kimsuky Multi-Stage Payload Retrieval - uni.txt/unicorn Path

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

Detects HTTP GET requests associated with the Kimsuky threat actor, specifically targeting the retrieval of payloads like uni.txt or files matching the test.bef_fri pattern from the /unicorn/ directory.