Malicious Scheduled Task M1onltor by SHADOW-EARTH-053

Ethan Andrews@eandrews

•updated May 4, 2026•11•1•413

Detects the creation or modification of a specific scheduled task containing the string "M1onltor". This is an artifact of SHADOW-EARTH-053 establishing continuous persistence for their side-loaded malware loaders.