Silent Rotor - CAI Decoy Executable Launch (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Detects the execution of the primary Rust-based payload named 'Подтверждение заказа продукции ЦАИ.exe' extracted from the ZIP archive, associated with the Silent Rotor campaign.