Sauron Loader (rnpkeys.exe) outbound HTTPS C2 channel used for screenshot exfil

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•1

Detects network connections over port 443 initiated by a process named 'rnpkeys.exe' running from a suspicious staging directory ('\ProgramData\keyroll\'). This behavior is characteristic of side-loaded payloads establishing command-and-control communication for data exfiltration.