helper[.]leuleu[.]net

Posts referencing this indicator

• Malicious Packagist Packages Disguised as Laravel Utilities Deploy Encrypted RAT

  C2 server domain used by the RAT for encrypted communication on port 2096

  2026-05-13