CosmicDuke | Detection.FYI

CosmicDuke Service Installation

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1543.003 attack.t1569.002 detection.emerging-threats ·
Share on:

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

Read More