Scheduled task 'IntelSoftwareUpdater' persists pythonw.exe run.pyw RAT

Duo Tech@duotech

•updated Aug 13, 2026•0•0•5

Detects creation of a scheduled task named 'IntelSoftwareUpdater' via schtasks.exe that launches pythonw.exe with run.pyw, used by the UNC5142 DeviceManager RAT for persistence, relaunching every 10 minutes.