Kimsuky/Red Lamassu JFMBackdoor Timestomping via fltMC.exe Sideloading

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of fltMC.exe from a location other than the standard Windows System32 directory, correlated with recent file creation or modification events in sensitive directories like ProgramData or User Public folders. This behavior is indicative of an attacker attempting to load malicious kernel-mode drivers or perform system-level operations using a renamed or moved system utility.