Threats Tagged 'registry persistence'

This is a sophisticated multi-stage infection campaign that uses PowerShell scripts stored in the Windows Registry, DNS TXT record exploitation, and steganographically encoded data within image and WAV audio files to deploy cryptocurrency mining malware. The attackers employ multiple evasion techniques including security control tampering and in-memory execution to avoid detection. Payloads are reconstructed from distributed sources rather than being written directly to disk, enabling covert and persistent cryptocurrency mining operations on compromised systems.