DeviceManager scheduled task persistence via schtasks.exe MicroUpdaterV1 with pythonw.exe target

Duo Tech@duotech

•updated Aug 6, 2026•3•0•6

Detects the creation of a scheduled task named 'MicroUpdaterV1' using the 'schtasks.exe' utility with an XML configuration file ('t.xml') that specifies 'pythonw.exe' as the task target. This behavior is associated with the persistence mechanism of the DeviceManager RAT as delivered by the DOUBLECUP loader.