Loading story…
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including AppInit_DLLs, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell CLSID command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under HKLM and HKCU to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context.
The examples included replacing .txt open commands, setting HKCU\Environment\UserInitMprLogonScript, creating malicious InprocServer32 registrations for COM objects, altering UninstallString values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack sethc.exe. The posts also tied several methods to known threat activity, citing groups and malware such as APT28, APT39, Turla, Kimsuky, APT3, APT29, APT32, APT38, APT41, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The content states that malware using default file-association hijacking was used in a campaign against Croatian government agencies. The campaign is explicitly anchored only to 2019 and attributed to unidentified cyber actors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers can maintain persistence on Windows by abusing **Winlogon** autostart mechanisms, including modification of registry values such as `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` and `Userinit`, as well as use of the **Winlogon Helper DLL** technique tracked by MITRE ATT&CK as `T1547.004`. By altering these settings, a malicious executable or DLL can be launched automatically during user logon, giving malware a reliable way to survive reboots and regain execution. Public technical material showed a C++ proof of concept that rewrites Winlogon registry keys to start a test payload at logon and noted that older Windows versions may also expose persistence through the `Winlogon\Notify` key. The technique requires elevated privileges, but it has been associated with real-world malware activity, including **Turla**, **Gazer**, and **Bazaar**. Defenders are advised to restrict local administrator access and monitor Winlogon-related autorun entries for unauthorized changes, including with tools such as **Sysinternals Autoruns**.
Aug 15, 2026
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026
A public malware-development tutorial and companion GitHub repository demonstrated a Windows persistence method that hijacks the **Certificate Propagation Service** (`CertPropSvc`) by changing the `ServiceDll` value under `HKLM\SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters` to an attacker-controlled DLL. Because the service loads that DLL when it starts or restarts, the technique can provide durable execution on compromised hosts while blending into a legitimate built-in Windows service; the material notes that administrative privileges are required to modify the `HKLM` registry path. The published proof of concept included simple C/C++ examples and repository files such as `meow.cpp`, `meow.dll`, `meow2.cpp`, `pers.c`, and `pers.exe`. One payload writes a marker string to a file to confirm execution, while another uses `WSAConnect` to establish a reverse shell and launch `cmd.exe`, illustrating how the hijack can move from persistence to interactive command execution if defenders do not detect the altered service DLL path.
Aug 14, 2026