Casbaneiro beacon exfil with 'client;' and VVx-4.3 marker string

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects network beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. The rule monitors for specific C2 communication patterns, including the 'client;' string and the 'VVx-4.3' version marker, which are characteristic of this malware's host reconnaissance and command-and-control exfiltration phase.