APT28 NotDoor Registry Persistence

Georg Lauenstein@gsec

•updated Jan 15, 2026•4•0•93

Detects APT28's NotDoor backdoor registry modifications to establish persistence and disable Outlook macro security. Modifies LoadMacroProviderOnBoot, Level, and General registry keys to enable silent macro execution.