Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
indicator
registry_key
Software\Microsoft\Windows\CurrentVersion\Run\CanonPrinter
copy defanged
copy refanged (live)
First seen
2026-05-13
Last seen
2026-05-13
Sightings
1
Posts referencing this indicator
UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities
Arctic Wolf
Registry Run key created by PlugX to establish persistence.
2026-05-13
Software\Microsoft\Windows\CurrentVersion\Run\CanonPrinter · registry key · cyfar.ca
