TLS cert impersonating Uzbekistan railway authority (SpiceRAT/NodeEdgeRAT C2)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•6

This rule detects network communication to known malicious IP addresses or sessions utilizing TLS certificates that impersonate the Uzbekistan railway authority (azure.uzrailwaystax). This behavior is characteristic of the SpiceRAT/NodeEdgeRAT malware families, which use these specific certificates to establish Command and Control (C2) channels.