NeedyMantis C2 beacon to hard-coded C2 URI /library/zip/

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.