Loading story…
Elastic Security Labs’ analysis of roughly 100,000 Windows malware samples found defense evasion to be the most common ATT&CK tactic, followed by privilege escalation, execution, and persistence. Frequently observed behaviors included Windows Defender tampering, process injection, DLL side-loading, parent-PID spoofing, abuse of Rundll32 and Regsvr32, malicious MSI installers, and NTDLL unhooking.
Commodity malware increasingly used UAC-bypass techniques—including methods that abuse Windows’ trust in protected directories—alongside TrustedInstaller impersonation, elevated parent-process spoofing, and bring-your-own-vulnerable-driver activity. Security teams should prioritize behavioral detections for these elevation and evasion patterns, as well as monitoring for script hosts, WMI, scheduled tasks, Run keys, services, and credential-store access that commonly accompany malware execution and persistence.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs analyzed more than 100,000 Windows malware samples and found defense evasion to be the most prevalent observed tactic. The analysis identified trusted-directory-mimicking UAC bypasses, often associated with DLL side-loading, as the leading UAC-bypass method in its dataset.
Tenable published technical research describing a User Account Control bypass technique based on mocking trusted directories.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Recent research shows attackers continue to rely on legitimate Windows administration features for lateral movement, with WMI, Scheduled Tasks, SMB admin shares, RDP, PsExec, and anomalous Kerberos activity remaining common across enterprise intrusions. VMware telemetry covering 489 multi-host intrusions found **44.7%** included lateral movement, typically across fewer than 20 hosts and using short, focused paths, while Gigamon detailed how remote WMI execution and Scheduled Tasks often blend into normal administration through DCE/RPC operations such as `ExecMethod`, `SchRpcRegisterTask`, `SchRpcRun`, and `SchRpcDelete`, frequently paired with SMB payload transfer and shared outbound command-and-control destinations. Newer Windows tradecraft is also exploiting **cross-session activation** and service manipulation to execute code under another user’s interactive session or persist more stealthily after compromise. Purple Team research described COM/DCOM abuse using `RunAs=Interactive User`, remote registry changes, and CLSID hijacking—including abuse of **SpeechRuntime.exe** via the CLSID `{655D9BF9-3876-43D0-B6E8-C83C1224154C}`—as well as tooling such as COMThanasia, PermissionHunter, SessionHop, and SpeechRuntimeMove; separate analysis showed attackers can evade simpler detections by abusing Windows Service recovery functions and registry-backed service creation. Across these techniques, defenders are urged to correlate process creation, registry access, service state changes, authentication context, and network telemetry, with attention to Windows events including **4688**, **4663**, **4657**, **7036**, and **7040**.
Aug 15, 2026
Threat actors are increasingly leveraging built-in Windows features to establish persistence and evade detection on compromised systems. Common persistence mechanisms include the abuse of registry keys, scheduled tasks, and Windows Management Instrumentation (WMI), which allow malware to survive reboots and maintain long-term access. These techniques often exploit legitimate system administration tools, making it challenging for defenders to distinguish malicious activity from normal operations. Security teams are advised to proactively hunt for indicators of compromise (IOCs) associated with these persistence methods, as even fileless malware can leave traces in system configurations or memory. Fileless malware represents a significant evolution in attack methodology by operating entirely in memory and utilizing trusted Windows binaries such as PowerShell, MSHTA, and rundll32. This approach enables attackers to bypass traditional signature-based antivirus solutions, as no malicious files are written to disk. Persistence for fileless malware can be achieved by embedding encoded scripts or commands within the Windows Registry, WMI, or Task Scheduler, allowing the malware to re-execute at startup without leaving conventional artifacts. Defenders must adapt detection strategies to monitor for unusual use of native tools and changes in system persistence mechanisms to effectively counter these threats.
Jun 29, 2026