httpMalice Backdoor Persistence via Service or Run Key

Brandon Rodriguez@BMRodriguez

•updated May 21, 2026•4•0•162

Detects the creation of the 'CacheDB' service or specific 'Everything' registry run keys, which are persistence mechanisms utilized by the httpMalice backdoor (a Kimsuky PebbleDash variant).