REF2924: how to maintain persistence as an (advanced?) threat

As cited

Copy frozen at 2026-09-20 07:46 UTC (site build).

threat intel

REF2924: how to maintain persistence as an (advanced?) threat

Elastic Security Labs documented persistence techniques employed by a threat group responsible for SIESTAGRAPH, NAPLISTENER, and SOMNIRECORD malware families. The analysis reveals methods the group uses to maintain long-term access to compromised systems.

Why it matters: Defenders using Elastic or similar detection tools should review these persistence mechanisms to identify and block similar techniques in their environments; organizations may already host this group's malware without realizing it.

Source published

2023-03-27 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-20 06:24 UTC