Red Lamassu JFMBackdoor Service Persistence via WinExec and sc start

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects suspicious service-based persistence activity associated with JFMBackdoor, specifically when fltMC.exe (a known host process) initiates child processes sc.exe or services.exe to create or start a service, using file paths located in C:\ProgramData\Microsoft\Network and specific registry key modification patterns.