VelvetCake Fileless In-Memory Download via medianewsonline C2

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•2

Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.