Red Lamassu JFMBackdoor fltMC.exe In-Memory DLL Load via VirtualAlloc

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the Windows Filter Manager utility (fltMC.exe) executing from a temporary directory (e.g., %TEMP% or %AppData%\Local\Temp) in an unusual manner. This behavior is consistent with the JFMBackdoor malware used by Red Lamassu to achieve reflective DLL loading of malicious payloads directly in memory, bypassing traditional disk-based execution methods.