BeepRAT UAC Bypass via Appinfo/TCC Loader Chain (Operation DragonClone)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.