Cybersecurity articles tagged #Persistence on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/notepad-plugin-abuse-lunchpoke-malware-establishes-persistencehttps://runtimerebel.com/blog/notepad-plugin-abuse-lunchpoke-malware-establishes-persistenceCERT-UA uncovers attacks where threat actors bundle malicious LunchPoke utility as a Notepad++ plugin for stealthy malware installation and persistence.Thu, 23 Jul 2026 17:27:43 GMTNotepadLunchPokeCERT UAMalwarePersistenceSupply Chain Attackhttps://runtimerebel.com/blog/cve-2026-50522-sharepoint-rce-exploitation-to-steal-machine-keyshttps://runtimerebel.com/blog/cve-2026-50522-sharepoint-rce-exploitation-to-steal-machine-keysCritical CVE-2026-50522 in Microsoft SharePoint is actively exploited to steal machine keys, enabling persistent access. Understand the threat and mitigation.Tue, 21 Jul 2026 21:12:05 GMTCVE-2026-50522SharePointRCEMachine KeysPersistenceMicrosofthttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopshttps://runtimerebel.com/blog/clicklock-macos-stealer-how-attackers-coerce-victims-via-app-kill-loopsClickLock is a new macOS infostealer that terminates essential system processes every 210ms to force users into disclosing their login passwords.Thu, 16 Jul 2026 14:03:10 GMTmacOSInfostealerClickLockSocial EngineeringPersistencehttps://runtimerebel.com/blog/analysis-of-obfuscated-powershell-loaders-delivering-remcos-rathttps://runtimerebel.com/blog/analysis-of-obfuscated-powershell-loaders-delivering-remcos-ratTechnical breakdown of a multi-stage PowerShell malware loader using scheduled tasks for persistence and Remcos RAT as the final payload.Tue, 23 Jun 2026 09:29:44 GMTRemcos RATPowerShellMalware LoaderPersistencehttps://runtimerebel.com/blog/junior-hacker-s-tailscale-openssh-post-c2-persistencehttps://runtimerebel.com/blog/junior-hacker-s-tailscale-openssh-post-c2-persistenceAnalysis of a junior hacker's TTPs, leveraging Tailscale and OpenSSH for persistent access to a French automotive business after their Havoc C2 server went offline.Wed, 17 Jun 2026 17:07:49 GMTTailscaleOpenSSHPersistenceHavoc C2Automotive SectorKeyloggerhttps://runtimerebel.com/blog/openclaw-claw-chain-vulnerabilities-credential-theft-persistencehttps://runtimerebel.com/blog/openclaw-claw-chain-vulnerabilities-credential-theft-persistenceAnalysis of 'Claw Chain' vulnerabilities in OpenClaw, an AI agent framework, detailing credential theft, privilege escalation, and persistence risks.Tue, 19 May 2026 00:58:13 GMTOpenClawAI Agent FrameworkClaw ChainCredential TheftPrivilege EscalationPersistenceApplication Securityhttps://runtimerebel.com/blog/active-directory-post-breach-persistence-why-password-resets-failhttps://runtimerebel.com/blog/active-directory-post-breach-persistence-why-password-resets-failExplaining why password resets fail to evict attackers from Active Directory due to Kerberos ticket persistence and MSV1_0 credential caching mechanisms.Mon, 11 May 2026 17:01:15 GMTActive DirectoryKerberosPersistenceKrbtgtIncident Responsehttps://runtimerebel.com/blog/unc6692-targets-microsoft-teams-to-deploy-snow-malwarehttps://runtimerebel.com/blog/unc6692-targets-microsoft-teams-to-deploy-snow-malwareUNC6692 is leveraging Microsoft Teams and social engineering to deliver the modular Snow malware suite, facilitating long-term persistence and data theft.Sat, 25 Apr 2026 16:17:06 GMTUNC6692Microsoft TeamsSNOW MalwareSocial EngineeringBackdoorPersistencehttps://runtimerebel.com/blog/firestarter-backdoor-exploits-cisco-firepower-asa-softwarehttps://runtimerebel.com/blog/firestarter-backdoor-exploits-cisco-firepower-asa-softwareCISA and NCSC reveal FIRESTARTER, a persistent backdoor targeting Cisco Firepower devices running ASA software, used in federal agency compromises.Sat, 25 Apr 2026 00:42:32 GMTCisco FirepowerFirestarter MalwareCISA AdvisoryAsa SoftwarePersistencehttps://runtimerebel.com/blog/firestarter-backdoor-infects-cisco-firewall-at-us-federal-agencyhttps://runtimerebel.com/blog/firestarter-backdoor-infects-cisco-firewall-at-us-federal-agencyAnalysis of the Firestarter backdoor on Cisco firewalls, detailing its remote access capabilities, post-patch persistence, and mitigation strategies.Fri, 24 Apr 2026 12:34:34 GMTFIRESTARTERCisco FirewallBackdoorFederal AgencyPersistenceRemote Accesshttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallhttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallCISA and NCSC warn of FIRESTARTER, an APT-deployed backdoor maintaining persistence on Cisco Firepower and Secure Firewall devices post-patching.Thu, 23 Apr 2026 16:44:19 GMTFIRESTARTERCisco FirepowerCisco Secure FirewallCisco ASABackdoorAPTCVE-2025-20333CVE-2025-20362LINE VIPERPersistencehttps://runtimerebel.com/blog/dragon-boss-adware-evolves-scheduled-tasks-windows-defender-evasionhttps://runtimerebel.com/blog/dragon-boss-adware-evolves-scheduled-tasks-windows-defender-evasionDragon Boss adware transforms into a persistent AV killer, using scheduled tasks to establish presence and disable Windows Defender protections on infected systems.Fri, 17 Apr 2026 00:45:20 GMTDragon BossAdwareAV EvasionWindows DefenderPersistenceScheduled Taskshttps://runtimerebel.com/blog/detecting-malicious-web-shells-analysis-of-persistence-and-ttpshttps://runtimerebel.com/blog/detecting-malicious-web-shells-analysis-of-persistence-and-ttpsDiscover how attackers use deceptive naming and pre-set credentials in web shells to maintain persistence and how to detect these malicious files on servers.Wed, 08 Apr 2026 08:35:56 GMTWeb ShellsPersistenceRce ExploitationIncident Responsehttps://runtimerebel.com/blog/whatsapp-vbs-malware-bypasses-uac-to-hijack-windows-systemshttps://runtimerebel.com/blog/whatsapp-vbs-malware-bypasses-uac-to-hijack-windows-systemsMicrosoft warns of a new campaign distributing VBS malware via WhatsApp, exploiting UAC bypass to establish persistence and remote access on Windows systems, starting…Wed, 01 Apr 2026 16:25:50 GMTWhatsAppVBScriptUAC BypassWindowsMalwarePersistenceRemote Accesshttps://runtimerebel.com/blog/telecom-sleeper-cells-and-llm-jailbreak-trends-weekly-analysishttps://runtimerebel.com/blog/telecom-sleeper-cells-and-llm-jailbreak-trends-weekly-analysisAn analysis of long-term persistence in telecom networks, LLM jailbreak methodologies, and regulatory shifts in UK age verification for Apple users.Mon, 30 Mar 2026 16:26:48 GMTTelecom SecurityLLM JailbreakPersistenceRegulatory ComplianceApplehttps://runtimerebel.com/blog/gsocket-backdoor-analysis-malicious-bash-script-delivery-and-impacthttps://runtimerebel.com/blog/gsocket-backdoor-analysis-malicious-bash-script-delivery-and-impactAnalysis of a malicious Bash script deploying the GSocket backdoor for persistent access, bypassing firewalls through advanced NAT traversal techniques.Fri, 20 Mar 2026 12:19:53 GMTGsocketBash MalwarePersistenceLinux SecurityNat Traversalhttps://runtimerebel.com/blog/hive0163-deploys-ai-assisted-slopoly-malware-for-persistent-accesshttps://runtimerebel.com/blog/hive0163-deploys-ai-assisted-slopoly-malware-for-persistent-accessThe Hive0163 threat actor is leveraging Slopoly, an AI-generated malware framework, to maintain persistence in ransomware campaigns and financial theft operations.Thu, 12 Mar 2026 20:13:13 GMTHive0163SlopolyAI Assisted MalwareRansomwarePersistencehttps://runtimerebel.com/blog/byovd-driven-xmrig-campaign-employs-time-based-logic-bombs-and-lateral-movementhttps://runtimerebel.com/blog/byovd-driven-xmrig-campaign-employs-time-based-logic-bombs-and-lateral-movementAn analysis of a sophisticated cryptojacking operation utilizing Bring Your Own Vulnerable Driver (BYOVD) techniques and wormable components to maximize Monero mining…Mon, 23 Feb 2026 20:18:27 GMTXMRigBYOVDCryptojackingPersistenceWormable