LCRYX Ransomware IFEO Debugger Hijacking via Registry Write

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects modifications to the Windows Image File Execution Options (IFEO) registry key where a debugger value is configured to point to scripting engines like VBScript or Windows Script Host (wscript/cscript). This technique is commonly used for persistence or to intercept process execution by forcing the execution of scripts when legitimate applications are launched.