TOKYOCORE lateral movement via ADMIN$/C$ share copy of fsociety.exe

Subhankar H@Andrewsec57

•updated Jul 27, 2026•1•0•6

Detects potential lateral movement by identifying the creation or modification of a file named 'fsociety.exe' on sensitive Windows administrative shares (ADMIN$ or C$). This behavior is consistent with the TOKYOCORE worm-like threat activity, where malicious binaries are replicated across the network.