CrySome RAT Persistence via CrySomeLoader Scheduled Task Creation

Duo Tech@duotech

•updated Jul 9, 2026•1•0•2

Detects the creation of a scheduled task via schtasks.exe identified by the specific command-line string associated with 'CrysomeLoader', configured to execute every 5 minutes.