Tokyocore Autorun Inf Worm

Duo Tech@duotech

•updated Jul 27, 2026•0•0•3

Detects autorun.inf files configured to auto-execute fsociety.exe, used by TOKYOCORE ransomware for worm propagation via network shares and removable drives