Stealer/1.0 enumeration of user files with .bak/.backup/.locked extensions

Subhankar H@Andrewsec57

•updated Aug 31, 2026•1•0•5

Detects file system operations targeting common user directories and specific file extensions (.bak, .backup, .locked) often associated with data exfiltration, staging, or ransomware activity.