TLS cert impersonating azure.uzrailwaystax[.]com reused across C2 hosts

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects network communication associated with the SilkParasite campaign, specifically targeting TLS connections that use spoofed certificates impersonating azure.uzrailwaystax.com or communication with known SpiceRAT command-and-control server IP addresses.