Red Lamassu JFMBackdoor Timestomping via fltMC.exe SetFileTime

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the use of the legitimate Windows utility fltMC.exe to perform timestomping (modifying file timestamps) on specific malicious or deployment-related files (such as FLTLIB.dll, scr.mui, and flt.bin) located in temporary directories. This activity is associated with the JFMBackdoor used by the Red Lamassu threat actor to evade timeline-based forensic analysis.