BlackBeard Persistence via File Association

Elgonad .@elgonad

•updated Mar 17, 2026•0•59

Detects the creation of a registry key used by the BlackBeard backdoor for persistence. The malware associates a custom file extension (.wdlp) with a malicious script (WebDeepPlayer.scr) to ensure it is executed on user logon.