Do Son A previously undetectable Linux backdoor called GhostPenguin was exposed by AI-driven threat hunting. The C++ malware uses RC5-encrypted UDP for stealthy, multi-threaded C2 operations.
UDP C2
FortiGuard exposed UDPGangster, a custom UDP backdoor deployed by MuddyWater APT. The malware evades network defenses and analysis by using UDP for C2 and checking for single-core CPUs/low RAM.