NeedyMantis WebSocket upgrade + RC4 google.com decoy key exchange

Ankit Mehta@Secvyn

•updated 28 days ago•0•0•0

Detects anomalous WebSocket upgrade requests using a suspicious Firefox/21.0 User-Agent followed by a C2 buffer containing 'google.com' associated with the NeedyMantis threat actor group.