RegPhantom
- Malware type
- rootkit
- Family
- Malware family
- Related IoCs
- 19 (19 malicious)
- Last IoC activity
- 2026-10-07 17:25:06
- Profile updated
- 2026-07-07 15:17:55
Context
According to Nexttron Systems, RegPhantom is a stealthy Windows kernel rootkit designed to give attackers code execution in kernel mode while leaving very little visible evidence behind. The malware abuses the Windows registry as a covert trigger mechanism: a usermode process can send an encrypted command through a registry write, which the driver intercepts and turns into arbitrary kernel-mode code execution.
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Regphantom_Auto (yara-rule)
- SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Regphantom (report)
- nextron-systems.com — Regphantom Backdoor Threat Analysis (report)