DcRAT Operation DragonReturn MixedSvc Persistence via Windows Service Creation

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the creation of a Windows service named 'MixedSvc' or services with lure-themed display names (e.g., related to 'Windows Mixed Reality') executing binaries from suspicious, user-writable directories. This pattern is consistent with the DcRAT persistence mechanism observed in the Operation DragonReturn espionage campaign.