When NSSM is configured to run an executable (e.g., C:\App\bin\start.exe ), it reads the path from the registry and spawns the target process. If the directory C:\App\bin\ or the file start.exe permits Write or Modify access to the Authenticated Users or Everyone groups, escalation is trivial. The attacker checks file system ACLs.

By following these recommendations, organizations can reduce the risk of exploitation and protect their systems and data from harm.

Attackers frequently target low-level accounts because they are easier to hijack via stolen credentials or social engineering before seeking a path to elevation.

If successful, the attacker’s reverse_shell.exe runs as .

In late 2024, researchers uncovered a threat group dubbed “Crypt Ghouls” targeting Russian businesses and government agencies with ransomware. According to analysis from Securelist, “to maintain access to the system, the attackers used the NSSM and Localtonet utilities”. The group deployed NSSM to create persistent services that would survive reboots and continue executing their malware under high‑privileged accounts. While this campaign did not specifically exploit CVE‑2025‑41686, it demonstrates that for persistence and privilege elevation.