Kimsuky NUKESPED zlrenu8.exe Registry Enumeration for Host Recon

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects host reconnaissance activity where the zlrenu8.exe process (associated with the NUKESPED backdoor/Kimsuky threat group) attempts to enumerate sensitive registry keys under HKLM\SOFTWARE and HKLM\SYSTEM. This behavior is indicative of post-exploitation discovery activities.