CHOSEN BRICK exfiltration via VultrObjects/StorjShare/Backblaze cloud object sto

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•0

Detects TLS connections to known CHOSEN BRICK cloud object-storage exfiltration endpoints (VultrObjects, StorjShare, Backblaze B2) and repeated Telegram Bot API document-upload calls consistent with data exfiltration. An earlier revision attempted to chain a Telegram-session flowbit to a later cloud-storage upload, but Suricata flowbits are scoped to a single flow and cannot correlate across the two separate connections involved here, so that cross-flow pair was removed as not functionally valid; each remaining rule fires independently on direct traffic to a known exfil channel.