Kimsuky WordPress Beacon via wasmer.app init Token Query

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

This rule detects network communication patterns indicative of the Kimsuky threat group using compromised WordPress sites hosted on wasmer.app for command and control (C2). It specifically looks for established HTTP requests to the .wasmer.app domain, targeting a specific WordPress uploads path and a unique token format in the URI string.