Khunt Registry hive dumps staged for cred theft (SAM/SECURITY/SYSTEM)

Ankit Mehta@Secvyn

•updated Aug 6, 2026•9•0•5

khunt actor did this after confirming SYSTEM access via KhuntCmd. This one's noisier - backup software and some AV tools do reg save legitimately, so tighten it to non-backup accounts / unmanaged paths if you get FPs.