Kimsuky Stella_Gary backdoor fixed-socket C2 connection

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.