OtterCookie Persistence Mechanisms

Tim Peck@timpeck

•updated Feb 3, 2026•1•0•55

Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.