PowerShell

This technical report details multiple methods for abusing Windows Services to achieve persistence and elevated privileges. It covers everything from traditional binary path modification to advanced techniques involving SDDL manipulation and service recovery hijacking.

Cybersecurity researchers from Microsoft and Trend Micro have uncovered sophisticated phishing campaigns targeting hospitality organizations in Europe and Asia. These attacks leverage malicious archives to deploy persistent malware like Node.js implants and blockchain-based RATs to maintain long-term access.

Attackers compromised legitimate DAEMON Tools installers to distribute trojanized, digitally signed binaries that execute malicious code upon system startup. The campaign utilizes an initial information collector to profile victims before deploying advanced payloads like the QUIC RAT for targeted exploitation.