Operation XENOFISCAL - Edgre Run Key to zuidrt.hta Execution Chain

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•2

This rule connects the creation of the 'Edgre' persistence registry key, which contains 'zuidrt.hta', to the actual process execution of 'zuidrt.hta'. This activity is associated with Operation XENOFISCAL, where the SideCopy threat group deploys the XenorRAT malware.