APT33 Tickler Backdoor Persistence via Run Key

ᴅᴜᴛᴄʜʙᴏʏ 😎@dutchboy

•updated Mar 31, 2026•2•0•104

Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.