Shadowray Process Masquerading And Resource Abuse

Tim Peck@timpeck

•updated Nov 19, 2025•2•63

Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.