Cron persistence via hw_probe.pyc scheduled through crontab

Ethan Andrews@eandrews

•updated Jul 24, 2026•0•0•2

Detects the mrmustard supply-chain implant establishing persistence by writing a crontab entry that invokes the compiled stealer 'hw_probe.pyc' every 15 minutes, or direct crontab command invocation referencing the file.