Loading story…
Microsoft said the China-linked Hafnium threat actor used a malware tool called Tarrask to maintain persistence on compromised Windows systems by abusing scheduled tasks. According to Microsoft Threat Intelligence Center, the malware creates scheduled tasks and related registry entries, then deletes the Security Descriptor value from the TaskCache\Tree registry path, causing the task to disappear from both Windows Task Scheduler and the schtasks command-line utility while remaining active on the host.
In one observed intrusion, Hafnium created a task named "WinUpdate" to restore command-and-control connectivity after interruptions. Microsoft said the activity targeted organizations in the telecommunications, internet service provider, and data services sectors between August 2021 and February 2022, showing the group expanding beyond the victim set associated with its earlier Microsoft Exchange exploitation and underscoring its detailed knowledge of Windows internals for stealth and defense evasion.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft Threat Intelligence Center publicly linked Hafnium to the Tarrask malware and described how it hides scheduled tasks by deleting the Security Descriptor value from the TaskCache\Tree registry path. The disclosure highlighted the malware's stealthy persistence and defense-evasion method on Windows systems.
Microsoft said the China-linked Hafnium threat actor used the Tarrask malware to maintain persistence on compromised Windows systems while targeting organizations in the telecommunications, internet service provider, and data services sectors. The activity was observed between August 2021 and February 2022 and included creation of a hidden scheduled task named "WinUpdate" to restore command-and-control connectivity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hancitor, also tracked as **Chanitor** and associated with **TA511/MAN1**, remained a persistent Windows malware loader delivered through phishing emails that lured users to malicious Word or Excel documents. The campaign shifted from direct malicious attachments to links hosted on compromised websites, fraudulent hosting accounts, and services such as Google Drive or Google Feed Proxy to evade mail filtering. Once macros were enabled, Hancitor profiled the host, checked external IP information, contacted command-and-control servers over HTTP, and commonly used recurring URI patterns such as `/8/forum.php`; researchers also documented hard-coded fallback C2 infrastructure and second-stage payloads hosted on compromised business websites. Intrusions tied to Hancitor showed it functioning as an initial-access malware that frequently delivered **Cobalt Strike**, **Ficker Stealer**, **Pony**, **NetSupport Manager RAT**, spam bot malware, and other follow-on tools. Incident reports described operators using Hancitor infections for rapid post-exploitation, including network discovery, SMB-based lateral movement, remote service execution, attempted access to `lsass.exe`, and in one case exploitation of **Zerologon** (`CVE-2020-1472`) to reach domain administrator privileges in under an hour. Multiple technical analyses also detailed Hancitor’s layered obfuscation, RC4- and XOR-based decoding, task parsing, and code injection into `svchost.exe`, underscoring its role as a mature malware delivery platform rather than a standalone payload.
Aug 15, 2026
A technical walkthrough demonstrated how **Windows Scheduled Tasks** can be abused to establish malware persistence, using a simple C proof of concept that creates a task named `MeowTask` to launch a payload at user logon with **SYSTEM** privileges and the highest run level. The author initially tested a payload that displayed a message box, then replaced it with one that writes a file after the message box failed to appear following reboot, illustrating how attackers can adapt payload behavior while keeping the persistence mechanism unchanged. The write-up also noted operational quirks during testing, including the task only working in the author’s virtual machine when the laptop was connected to power rather than running on battery. The technique aligns with tradecraft previously associated with threat actors including **APT17** and **APT41**, reinforcing that scheduled task creation remains a practical persistence method defenders should monitor for, particularly unusual or unauthorized tasks that may be detectable or blockable through EDR controls.
Aug 15, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026