TwinAPI COM Hijacking Persistence - ForumTroll APT

TEMP123 TEMP123@TEMP123

•updated Oct 27, 2025•1•0•86

Detects the creation of a specific COM object registry key in the HKEY_CURRENT_USER hive to hijack the legitimate 'twinapi.dll' component. This persistence technique (T1546.015) was used by the ForumTroll APT group to load the LeetAgent and Dante spyware.