Loading story…
A Windows persistence technique using Image File Execution Options (IFEO) and related registry settings was documented as a way to hijack process execution and launch attacker-controlled payloads. The method modifies keys under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and HKLM\Software\Microsoft\Windows NT\CurrentVersion\SilentProcessExit so a chosen executable can trigger malicious code either when the target process starts or when it exits. One demonstrated scenario used mspaint.exe to launch a payload after a silent exit, while an alternate approach used the IFEO Debugger value to run the payload as soon as the target application was opened.
The technique aligns with MITRE ATT&CK T1183, which covers execution flow hijacking through IFEO injection, and it remains relevant because it can provide stealthy persistence on Windows systems through native registry features. Reporting on the method noted prior use in real intrusions, including activity associated with APT29 and SUNBURST, underscoring its value for defenders monitoring registry changes tied to IFEO, SilentProcessExit, and suspicious debugger redirection for common processes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On the publication date of the blog post, a researcher published a walkthrough showing how to abuse IFEO and SilentProcessExit registry settings to launch a payload via mspaint.exe, along with an alternate Debugger-based method.
The references identify MITRE ATT&CK's IFEO Injection technique as related background and include the ATT&CK entry for technique T1183.
The reference also states that the same IFEO-based persistence technique was used by SUNBURST in the wild.
The reference states that the Windows Image File Execution Options persistence trick has been used in real-world operations by APT29.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026
Palo Alto Networks detailed a persistence technique used in recent **Sofacy** intrusions that abuses the Microsoft Office **"Office Test"** registry mechanism to launch malware each time an Office application starts. The method relies on registry keys associated with Office test features, allowing attackers to execute a malicious DLL or payload while blending into normal Office-related activity and maintaining access on compromised Windows systems. The reporting describes the technique as a stealthy post-compromise persistence method rather than an initial access vector, highlighting how it can help Sofacy survive reboots and user logoffs while evading casual inspection. By tying the malware to trusted Office startup behavior, the attackers gained a durable foothold that defenders would need to detect through close inspection of unusual Office-related registry entries and associated payloads.
Jul 12, 2026