TerraStealerV2/TerraLogger C2 and Exfiltration Detection

Michael Francess@MFrancess

•updated May 9, 2025•3•47

Detects network connections to known TerraStealerV2/TerraLogger C2/exfiltration domains (wetransfers.io, api.telegram.org) initiated by suspicious processes, or the creation of the specific output zip file used by TerraStealerV2.