Kimsuky NUKESPED zlrenu8.exe Keystroke Logger Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•2

Detects the execution of the NUKESPED backdoor component 'zlrenu8.exe', which is associated with Kimsuky threat actor activity. This component is known to function as a keystroke logger using SetWindowsHookEx to capture user input.