REF2924: how to maintain persistence as an (advanced?) threat

Elastic Security Labs reports on activity attributed to REF2924, describing evolution from custom malware to reuse of open-source tools and public source code. The publication analyzes a .NET Behinder/Godzilla-style webshell, a tiny .NET persistence binary (kavUpdate.exe) that creates and elevates a domain account and exports NTDS backups, and the actor’s use of tools such as AdFind, TFirewall, Impacket/secretsdump, and NTDSDumpEx for credential harvesting and lateral movement; it includes YARA detection, hashes, and recommended detection logic.