Loading story…
A technical walkthrough demonstrated how Windows Scheduled Tasks can be abused to establish malware persistence, using a simple C proof of concept that creates a task named MeowTask to launch a payload at user logon with SYSTEM privileges and the highest run level. The author initially tested a payload that displayed a message box, then replaced it with one that writes a file after the message box failed to appear following reboot, illustrating how attackers can adapt payload behavior while keeping the persistence mechanism unchanged.
The write-up also noted operational quirks during testing, including the task only working in the author’s virtual machine when the laptop was connected to power rather than running on battery. The technique aligns with tradecraft previously associated with threat actors including APT17 and APT41, reinforcing that scheduled task creation remains a practical persistence method defenders should monitor for, particularly unusual or unauthorized tasks that may be detectable or blockable through EDR controls.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A technical walkthrough demonstrated how to abuse Windows Scheduled Tasks for persistence by creating a task named "MeowTask" that runs a payload at user logon as SYSTEM with the highest privileges. The author showed testing with an initial message-box payload and a revised file-writing payload that successfully created meow.txt after logon.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Threat actors are increasingly leveraging built-in Windows features to establish persistence and evade detection on compromised systems. Common persistence mechanisms include the abuse of registry keys, scheduled tasks, and Windows Management Instrumentation (WMI), which allow malware to survive reboots and maintain long-term access. These techniques often exploit legitimate system administration tools, making it challenging for defenders to distinguish malicious activity from normal operations. Security teams are advised to proactively hunt for indicators of compromise (IOCs) associated with these persistence methods, as even fileless malware can leave traces in system configurations or memory. Fileless malware represents a significant evolution in attack methodology by operating entirely in memory and utilizing trusted Windows binaries such as PowerShell, MSHTA, and rundll32. This approach enables attackers to bypass traditional signature-based antivirus solutions, as no malicious files are written to disk. Persistence for fileless malware can be achieved by embedding encoded scripts or commands within the Windows Registry, WMI, or Task Scheduler, allowing the malware to re-execute at startup without leaving conventional artifacts. Defenders must adapt detection strategies to monitor for unusual use of native tools and changes in system persistence mechanisms to effectively counter these threats.
Jun 29, 2026