Storm-0978 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/storm-0978/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 13 Nov 2026 06:51:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPSFactoryBuffer COM InProcServer32 Registry Hijackinghttps://feed.craftedsignal.io/briefs/2026-11-psfactorybuffer-com-hijack/Fri, 13 Nov 2026 06:51:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-psfactorybuffer-com-hijack/The RomCom threat actor uses COM hijacking of the PSFactoryBuffer CLSID to establish persistence by redirecting execution to a malicious DLL via the InProcServer32 registry key.The RomCom threat actor has been observed utilizing COM hijacking to achieve persistence on compromised Windows systems. The attack involves modifying the InProcServer32 subkey for the PSFactoryBuffer CLSID ({c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}), which is normally associated with ActXPrxy.dll. By replacing the default value with a path to a malicious DLL, attackers ensure their code is loaded by processes that initialize this COM object.

Impact

Successful exploitation allows for the execution of code within the context of any process that loads the hijacked COM object, facilitating persistence.

Recommendation

  • Deploy the provided Sigma rule to monitor for unauthorized modifications to the PSFactoryBuffer registry key.
  • Baseline legitimate registry values for InProcServer32 to identify deviations from the standard ActXPrxy.dll paths.
]]>highthreatpersistenceprivilege-escalationwindowscom-hijacking