Anatomy of a disguised botnet deploy: how we caught a hidden C2 bot on our platform and automated the defense
https://railyard.run/blog/anatomy-of-a-disguised-botnet-deploy/
RailyardAnatomy of a disguised botnet deploy: how we caught a hidden C2 bot on our platform and automated the defense · RailyardA new signup deployed an app that looked ordinary and was actually an obfuscated remote-access bot. Here is the full breakdown — the loader, the decoded payload, why our container isolation contained it, and the deploy-time scanner that now blocks the whole class automatically.
commit 24d7513