Red Lamassu JFMBackdoor Timestomping via fltMC.exe on C:\Users\public\jfm

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances of the JFMBackdoor malware performing timestomping operations within the 'C:\Users\public\jfm\' directory. The malicious activity involves the use of fltMC.exe to perform DLL sideloading, followed by modifying file timestamps to evade forensic analysis and timeline reconstruction, specifically observed as part of the Red Lamassu command 0xE subcommand 0x10.