Kimsuky Stella_Gary C2 beacon to /unicorn/ path

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

Detects outbound HTTP requests to known Kimsuky command and control (C2) infrastructure associated with the Stella_Gary campaign. The rule monitors for specific URI patterns ('/unicorn/mort.php' or '/unicorn/uni.txt') commonly used by this threat actor for beaconing.