Kimsuky WordPress C2 infection beacon via wp-content/uploads/init token

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•0

This rule detects HTTP GET requests to a specific URI path ('/wp-content/uploads/init/') on the domain 'wasmer.app', which is associated with Kimsuky (APT43) C2 beaconing activity. The presence of a token parameter in the URI and the structure of the request indicates an established connection for command and control purposes.