T1543.002

Systemd Service

discovered 2026-05-26

Rust infostealer installs a systemd USER service masquerading as a benign daemon (observed colord, haveged) at ~/.config/systemd/user/<daemon>.service pointing at ~/.local/bin/<daemon> for persistence (Amazon Inspector).

View on MITRE ATT&CK

Seen in packages

npm forge-jsxyuses
npm forge-jsx4uses
npm pino-zoduses
npm zod-pinouses
npm compose-logger-standuses
npm zod-pino434uses
npm zod-pino444uses
npm zredis-typeduses
npm pinokio-redisuses
npm js-logger-packuses
npm atomic-lockfileuses
npm @apexcraft/nano-keyuses

Campaigns

miasma-train-p1uses
forge-jsx RATattributed-to
Contagious Interviewattributed-to
Atomic Archattributed-to
wshu.net npm Credential-Stealer Campaignattributed-to