Kimsuky NUKESPED zlrenu8.exe Backdoor Deployment via ProgramData

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.