Loading story…
Researchers published proof-of-concept Windows persistence techniques that abuse registry-controlled DLL load paths to force trusted processes to load attacker-controlled libraries. One method modifies HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007 by changing the LibraryPath value, causing socket-using applications such as Microsoft Edge to load a malicious DLL when launched; the demonstration on Windows 11 x64 required administrative privileges and used a benign message-box payload. A related earlier technique targeted HKLM\Software\Microsoft\Cryptography\Offload, where setting ExpoOffload to a rogue DLL reportedly caused cryptography-related processes including svchost.exe to load it.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A later proof-of-concept article described modifying the LibraryPath value under HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007 to force loading of an attacker-controlled DLL. The demonstration on Windows 11 x64 showed Microsoft Edge and other socket-using programs loading the DLL after the registry change.
A proof-of-concept article described a Windows persistence and DLL hijacking technique that sets the ExpoOffload value under HKLM\Software\Microsoft\Cryptography\Offload to an attacker-controlled DLL. The demonstration reported the DLL being loaded during cryptographic activity by processes including svchost.exe and ProcessHacker.exe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Attackers can maintain persistence on Windows by abusing **Winlogon** autostart mechanisms, including modification of registry values such as `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` and `Userinit`, as well as use of the **Winlogon Helper DLL** technique tracked by MITRE ATT&CK as `T1547.004`. By altering these settings, a malicious executable or DLL can be launched automatically during user logon, giving malware a reliable way to survive reboots and regain execution. Public technical material showed a C++ proof of concept that rewrites Winlogon registry keys to start a test payload at logon and noted that older Windows versions may also expose persistence through the `Winlogon\Notify` key. The technique requires elevated privileges, but it has been associated with real-world malware activity, including **Turla**, **Gazer**, and **Bazaar**. Defenders are advised to restrict local administrator access and monitor Winlogon-related autorun entries for unauthorized changes, including with tools such as **Sysinternals Autoruns**.
Aug 15, 2026
A public malware-development tutorial and companion GitHub repository demonstrated a Windows persistence method that hijacks the **Certificate Propagation Service** (`CertPropSvc`) by changing the `ServiceDll` value under `HKLM\SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters` to an attacker-controlled DLL. Because the service loads that DLL when it starts or restarts, the technique can provide durable execution on compromised hosts while blending into a legitimate built-in Windows service; the material notes that administrative privileges are required to modify the `HKLM` registry path. The published proof of concept included simple C/C++ examples and repository files such as `meow.cpp`, `meow.dll`, `meow2.cpp`, `pers.c`, and `pers.exe`. One payload writes a marker string to a file to confirm execution, while another uses `WSAConnect` to establish a reverse shell and launch `cmd.exe`, illustrating how the hijack can move from persistence to interactive command execution if defenders do not detect the altered service DLL path.
Aug 14, 2026