Loading story…
A public malware-development tutorial and companion GitHub repository demonstrated a Windows persistence method that hijacks the Certificate Propagation Service (CertPropSvc) by changing the ServiceDll value under HKLM\SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters to an attacker-controlled DLL. Because the service loads that DLL when it starts or restarts, the technique can provide durable execution on compromised hosts while blending into a legitimate built-in Windows service; the material notes that administrative privileges are required to modify the HKLM registry path.
The published proof of concept included simple C/C++ examples and repository files such as meow.cpp, meow.dll, meow2.cpp, pers.c, and pers.exe. One payload writes a marker string to a file to confirm execution, while another uses WSAConnect to establish a reverse shell and launch cmd.exe, illustrating how the hijack can move from persistence to interactive command execution if defenders do not detect the altered service DLL path.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A tutorial post described a Windows persistence technique that hijacks the Certificate Propagation Service (CertPropSvc) by changing its ServiceDll registry value under HKLM\SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters to an attacker-controlled DLL. The demonstration showed payload execution when CertPropSvc is restarted, including a DLL that writes a marker file and a reverse-shell DLL.
The latest visible GitHub commit for the tutorial repository was "malware persistence 28: add readme." The repository snapshot dates that commit to September 17, 2025.
Repository files associated with the persistence tutorial, including meow.cpp, meow.dll, meow2.cpp, pers.c, and pers.exe, were committed under a label indicating "malware persistence 28." The repository snapshot dates these file-associated commits to September 16, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026
Researchers published proof-of-concept Windows persistence techniques that abuse registry-controlled DLL load paths to force trusted processes to load attacker-controlled libraries. One method modifies `HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007` by changing the `LibraryPath` value, causing socket-using applications such as **Microsoft Edge** to load a malicious DLL when launched; the demonstration on Windows 11 x64 required administrative privileges and used a benign message-box payload. A related earlier technique targeted `HKLM\Software\Microsoft\Cryptography\Offload`, where setting `ExpoOffload` to a rogue DLL reportedly caused cryptography-related processes including `svchost.exe` to load it.
Aug 15, 2026