One Day Sec

How does PoisonFrog achieve persistence on the victim machine?

PoisonFrog creates two scheduled tasks named `\UpdateTasks\UpdateTask` and `\UpdateTasks\UpdateTaskHosts`, both running every 10 minutes. These tasks execute `UpdateTask.vbs`, which loads two PowerShell scripts (`dUpdater.ps1` and `hUpdater.ps1`) with current user and System permissions, as detailed in the Analysis of APT34 Leaked Tools - PoisonFrog and Glimpse article.
PoisonFrogpersistencescheduled tasksPowerShellAPT34

Browse all Q&A →