Swarm wallet file access followed by frameworkmetrics.xyz C2 contact

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects a non-standard process accessing Swarm cryptocurrency wallet files (swarm.key or config.yaml) followed within one hour by network connections to a known C2 domain (frameworkmetrics.xyz). It filters out routine access based on baseline activity.