ROOFDECK/FLATROOF dead-drop C2 resolution via Pastebin, Nostr, Telegram

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•4•0•5

Detects a sequence where a non-browser process connects to a dead drop/paste or chat service (such as Pastebin, Nostr, or Telegram), followed on the same device by contact with the FLATROOF C2 webhook domain.