Kimsuky Stella_Gary C2 HTTP beacon to /unicorn/ path masquerading as legitimate browsing

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.