Grixba Geofencing via HKLM CustomLocale en-US Registry Read

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.