CLAIM-2026-09-25-04
The implant is a 16.4 MB 64-bit Windows executable compiled in Go, re-executing at randomised 5 to 15 minute intervals and exfiltrating AES-256-GCM encrypted data via Discord webhooks.
Why it matters
The cadence and the webhook are the host-side signals a defender can actually key on.
Sources
- ciscotalos2026closed