Storm-2561 - Scheduled Task Persistence for Stealer (T1053.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Correlates the fake VPN installer creating a scheduled task pointing to the high-entropy AppData directory to ensure the stealer runs on boot.