Red Lamassu JFMBackdoor Batch Dropper Downloading to %TEMP%

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.