NightSpire Ransomware Chrome RDP Persistence

Duo Tech@duotech

•updated Jun 9, 2026•3•0•9

Detects the execution of Chrome Remote Desktop (remoting_host.exe) with daemon flags, which NightSpire ransomware operators use to establish persistence.