TuglaInsaatci Stego Loader HKCU Run Persistence via Hidden PowerShell .ps1 in %TEMP%

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects a registry modification to the HKCU Run key that executes a PowerShell script located in the %TEMP% directory. This behavior is associated with the TuglaInsaatci steganographic .NET loader campaign, often used to drop commodity malware such as Remcos RAT.