TuglaInsaatci Stego Loader Run Key Persistence: AppData\Roaming Exe within 5m

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•7

Detects the creation of an executable in the user's AppData\Roaming directory followed by the modification of a Windows Registry 'Run' key to point to that executable. This behavior is associated with the TuglaInsaatci loader, which uses this pattern for persistence.