🎯 Registry Run Key persistence

The items that name it 8

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  writeup2026-09-30

  add_to_run command creates HKCU Run key value launching Antino executable at user logon

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeup2026-09-28It is written here as Registry Run key persistence (T1547.001).

  HKCU Run key named 'Canon Configuration Reader' (V1) or 'Stardock DeElevation Tool' (V2) re-created automatically if deleted.

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeup2026-08-19

  Ledger implant creates a 'Ledger Wallet Installer' Run entry in the registry pointing at MsBuild (persistence left incomplete)

• Anatomy of a Deno-Based Proxy & RAT
  writeup2026-06-15It is written here as Registry Run key persistence (T1547.001).

  back.js writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value Deno_AutoRun to relaunch conhost.exe --headless deno.exe --allow-run app.js

• Supply Chain Compromise of axios npm Package
  writeup2026-03-31It is written here as Registry Run key persistence (T1547.001).

  Windows RAT adds HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate pointing to system.bat, which re-fetches the RAT on every login

• How Fake OpenClaw Installers Spread GhostSocks Malware
  writeup2026-03-04

  serverdrive.exe decrypts to update.exe and sets a user run key for persistence

• Botnet Fenix
  writeup2024-08-22

  persistence established via \Software\Microsoft\Windows\CurrentVersion\Run, re-fetching and executing the .NET payload (uiH.xls) via PowerShell on a hidden window with a delay

• N-IOCs to Rule Them All
  writeup2023-12-31It is written here as Registry Run Key persistence (IOC #4).

  Malware creates Run-Key registry entries so it auto-starts at login; monitored via Sysmon event ID 13