Topic

Endpoint persistence

The mechanisms software uses to survive reboot on a host, such as scheduled tasks, registry run keys and launch agents, and the detection work aimed at them.

Current clusters

security1 publisher

ChainScript RAT resolves its command channel through a Polygon smart contract

Blackpoint says a fake Spotify MSI, launched through msiexec.exe, ends with a Node.js agent that reads its live C2 address off a Polygon contract. The same implant has also shipped as Zoom and Teams.

Publishers:thehackernews.com

Reality

Evidence60
Adoption45
Hype gap+10
Incentives70
Confidence55