APT37 NarwhalRAT Scheduled Task Persistence

nomit vyas@xoxo

•updated Jun 25, 2026•2•0•6

Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.