Kimsuky NUKESPED HKCR\exefile Shell Open Command Hijack via Registry Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects unauthorized registry modifications to file association handlers under HKCR and HKCU. This behavior is used to achieve persistence by hijacking the default command executed when opening specific file types, a technique identified in Kimsuky APT's NUKESPED post-exploitation activity.