Fake .NET Runtime Registry Persistence

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•4•0•34

Detects registry run key additions that masquerade as the legitimate .NET Runtime Optimization Service. This behavior is used by the Lorem Ipsum loader (associated with Rapid Brigantine) to establish persistence by executing a payload dropped in C:\ProgramData\ upon user login.