BlueNoroff VBScript Implant Multi-Method Payload Execution via wscript/curl

Duo Tech@duotech

•updated Jul 24, 2026•5•0•8

Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.