🎯 Persistence via malicious Windows service

The items that name it 3

• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  article2026-10-09

  Creating a Windows service masquerading as Microsoft Edge Update to run a modified NSSM utility (msedge.exe) with System privileges, ensuring the miner stays running

• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeup2026-10-08

  Creation of MicrosoftEdgeUpdateSvc service running msedge.exe (modified NSSM) with SYSTEM privileges to keep the miner running.

• Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
  writeup2025-12-22

  sc.exe used to create a Windows service named WindowsUpdate to launch dllhost.exe, though it failed to start in Incidents 2 and 3.