BelialDemonThreat actor

“The list below includes DLL names for dynamic API resolution, User-Agent strings, WQL queries, registry paths, format strings, and EDR process names used for security product detection:”

“These are the only four APIs the shellcode resolves directly, and everything else is handled later by the embedded payloads:”

“With AstarionRAT active on the initial endpoint, the operator established persistence via a scheduled task named Application Maintenance, configured to execute Core.exe from C:\ProgramData\2895e798a2579e6\.”

“Shellcode decryption via brute-force key recovery”

“With 24 commands, RSA-encrypted C2 traffic disguised as application telemetry, a SOCKS5 proxy, credential theft, reflective code loading, and port scanning capabilities,”

“…uary 2026, the Huntress Tactical Response team and SOC responded to a hands-on intrusion that began with a ClickFix infection, the social engineering technique that just won't die.”