Rapuncel-style raw-TCP POST /upload exfil of staged stealer archive

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

Detects network activity associated with the Rapuncel malware, including raw TCP exfiltration of files via POST requests to /upload, connections to known malicious C2 infrastructure, and repeated exfiltration retry patterns.