Sauron Loader rnpkeys.exe Beaconing from ProgramData\keyroll

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•3

Detects an outbound network connection initiated by 'rnpkeys.exe' when executing from a non-standard 'ProgramData\keyroll' directory. This behavior is associated with the early stages of a Command and Control (C2) registration sequence, where an encrypted loader initiates network contact before subsequent staged communication.