# Legitimate Tool Abuse for Persistence

Renamed or misused native/RMM/tunneling binaries, odd scheduled tasks, and hidden payloads in registry or config files

_Area: Network devices and IoT. Seen in 2 disclosed reports; latest 2021-03-16. Updated 2026-11-03._

## How it works
Attackers avoid writing new malware by reusing tools the system already trusts: scheduled tasks, PowerShell, native-looking binaries, and legitimate tunneling or remote-control software. The broken assumption is that a trusted component's presence or name means trusted behavior. A task named after a real one, a `conhost.exe` that is really a tunnel, or a Run key pointing at a copied installer all pass name-based checks while executing attacker payloads, often as Local System [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md).

## Where it shows up
- Scheduled tasks whose names splice one legitimate task's path with another task's name, or that carry extra Exec/Action entries appended to a real task [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md)
- Base64 blobs stored in registry values or fetched from cloud storage (Dropbox) by a PowerShell launcher [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md)
- Supposedly native processes (`conhost.exe`) with command-line flags like `--config`, `--region`, `start --all` that belong to a tunneling tool [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md)
- VBScript or Run-key persistence launching hidden PowerShell [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md)
- Copies of installers or tools placed in `ProgramData`, with broken process ancestry [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)
- Config files exposing internal RDP/VNC/proxy ports, and VNC servers on non-standard ports matching a tunnel [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md)
- Hidden desktops created via `CreateDesktopW`/`SetThreadDesktop` [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)

## How to review
For every persistence point (task, Run key, service, startup script), verify the full chain: what launches it, what it downloads or decodes, and what identity it runs as. The invariant: each scheduled task, autorun entry, and listening port must map to a known, documented purpose and binary hash. Check task XML for appended actions and duplicate-looking names; check registry values for Base64; check process command lines against the real binary's expected flags; check listening ports against declared services. A renamed binary is unsafe regardless of its filename.

## How finders spotted it
- Observed dozens of suspicious scheduled tasks running a persistent payload as Local System, then reverse-engineered the PowerShell chain, registry storage, and XML template [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md)
- Noticed a spike in malvertising, traced fake-installer infections to unknown hVNC malware, and pivoted on hardcoded request-buffer bytes in VirusTotal VTGrep to cluster 550+ samples [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)
- Spotted a persistent VBScript and a `conhost.exe` whose arguments (`--config`, `--region`) matched ngrok, then pivoted to its config and the VNC config [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md)

## Variants seen
- Scheduled-task + registry/Dropbox Base64 payload running as Local System [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md)
- Fake installer copying to ProgramData, Run-key persistence, hidden desktop for remote control [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md)
- Renamed ngrok tunneling RDP/VNC/proxy ports, launched by VBScript and hidden PowerShell [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md)

## Why fixes fail
Kaseya's automated removal was defeated by renamed registry keys and a backdoored legitimate Microsoft task (`sihboot`), so cleanup missed the foothold [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md).

## Impact and severity
Full remote desktop access and internal lateral movement via tunneled proxy ports [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md); stealthy unobserved control plus crypto theft via wallet enumeration and clipboard grabber [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md); cryptomining as Local System with persistence surviving cleanup [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md). Severity rises with Local System execution, hidden desktops bypassing fraud detection, and tunnels reaching internal networks.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **ngrok** (version not stated): Abusing Ngrok: Hackers at the End of the Tunnel. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md
- **Kaseya VSA** (version not stated): Deep Dive: Kaseya VSA Mining Payload. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-abusing-ngrok-hackers-at-the-end-of-the-tunnel.md