SecuriTricks - dll sideloading

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

A cluster of suspicious activity, tracked as CL-STA-1020, has been targeting governmental entities in Southeast Asia since late 2024. The threat actors have developed a new Windows backdoor called HazyBeacon, which uses AWS Lambda URLs for command and control communication. This technique leverages…

dropbox

dll sideloading

google drive

2025-07-14

governmental entities

hazybeacon

Published: July 14, 2025

Downloadable IOCs: 7

Applications of Snake Keylogger in Geopolitics: Abuse of Trusted Java Utilities in Cybercriminal Activities

A new phishing campaign using Snake Keylogger, a Russian-origin stealer, has been discovered targeting various victims including corporations, governments, and individuals. The campaign uses spear-phishing emails offering petroleum products, with malicious attachments exploiting the legitimate jsad…

Published: July 6, 2025

Downloadable IOCs: 0

May 2025 Infostealer Trend Report

This analysis examines the distribution trends of Infostealer malware in May 2025. It highlights the use of SEO poisoning to distribute malware disguised as cracks and keygens. LummaC2, Vidar, StealC, Rhadamanthys, and Amadey were the main Infostealers observed. Distribution methods included posts …

Published: June 18, 2025

Downloadable IOCs: 3

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Custom Arsenal Developed to Target Multiple Industries

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and Bypass…

vulnerability exploitation

brute ratel

multi-industry targeting

Published: May 27, 2025

Linked vulnerabilities : CVE-2024-9047 (CVSS 9.8), CVE-2024-51378 (CVSS 10.0), CVE-2024-51567 (CVSS 10.0), CVE-2024-56145, CVE-2025-31324 (CVSS 10.0), CVE-2017-9805, CVE-2024-27199, CVE-2024-27198, CVE-2021-22205

Downloadable IOCs: 185

Targeting Taiwan & Japan with DLL Implants

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads.…

Published: May 12, 2025

Downloadable IOCs: 16

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strik…

Published: May 2, 2025

Downloadable IOCs: 2

Finding Minhook in a sideloading attack – and Sweden too

A threat actor campaign targeting multiple locations was observed in late 2023 and early 2024. Initially focused on the Far East, it later shifted to Sweden. The attacks used DLL sideloading techniques, employing the Minhook library to detour Windows API calls. The clean loader was obtained from in…

Published: May 1, 2025

Downloadable IOCs: 0

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

A campaign targeting users in Ukraine with malicious LNK files has been observed since November 2024. The files, using Russian words related to troop movements as lures, run a PowerShell downloader contacting geo-fenced servers in Russia and Germany. The second stage payload uses DLL side loading t…

Published: March 28, 2025

Downloadable IOCs: 0

Stealers and backdoors are spreading under the guise of a DeepSeek client

Cybercriminals are exploiting the popularity of DeepSeek, a powerful reasoning large language model, by creating fake websites that mimic the official DeepSeek chatbot site and distribute malicious code disguised as a client. Three main schemes were identified: a Python stealer targeting user data …

Published: March 6, 2025

Downloadable IOCs: 9

Operation SalmonSlalom

A sophisticated cyberattack targeting industrial organizations in the Asia-Pacific region has been uncovered. The attackers utilized legitimate Chinese cloud services and a multi-stage payload delivery framework to evade detection. The campaign, named SalmonSlalom, employed techniques such as nativ…

Published: February 26, 2025

Downloadable IOCs: 160

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 researchers have discovered connections between Stately Taurus, a threat actor targeting ASEAN countries, and the Bookworm malware family. Analysis of infrastructure and code overlaps revealed links between recent Stately Taurus attacks and Bookworm samples dating back to 2015. The group ha…

infrastructure overlap

bookworm

Published: February 20, 2025

Downloadable IOCs: 0

Python-Based NodeStealer Version Targets Facebook Ads Manager

The latest variant of NodeStealer has evolved from JavaScript to Python, expanding its data theft capabilities. Trend Micro's MXDR team uncovered this advanced version in a campaign targeting a Malaysian educational institution, linked to a Vietnamese threat group. The malware now targets Facebook …

Published: December 19, 2024

Downloadable IOCs: 5

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

The FLUX#CONSOLE campaign involves a sophisticated tax-themed phishing attack that exploits Microsoft Management Console (MSC) files to deliver a stealthy backdoor payload. Threat actors use tax-related lures to trick users into executing malicious code. The attack leverages MSC files, which are no…

Published: December 18, 2024

Downloadable IOCs: 5

Threat Actor Targets Manufacturing Industry With Malware

A sophisticated cyberattack campaign targeting the manufacturing industry has been identified, utilizing a deceptive LNK file disguised as a PDF document. The attack leverages multiple Living-off-the-Land Binaries and Google Accelerated Mobile Pages to evade detection. The threat actor employs vari…

Published: December 5, 2024

Downloadable IOCs: 0

RobotDropper Automates the Delivery of Multiple Infostealers

A phishing campaign is distributing Trojanized MSI files that use DLL sideloading to execute LegionLoader, a malicious program that delivers multiple infostealers. The campaign is widespread, with over 400 unique malicious MSI files identified since June 2024. Victims are targeted globally through …

Published: November 26, 2024

Downloadable IOCs: 5

HijackLoader evolution: abusing genuine signing certificates

A report by HarfangLab EDR and MITRE ATT&CK on the threat posed by the Lumma Stealer malware, published on 11 October, 2024, outlines the tactics used to deploy the malware.

Published: October 15, 2024

Downloadable IOCs: 69

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

A cyber espionage campaign using the ToneShell backdoor, associated with Mustang Panda, has been detected targeting attendees of the 2024 IISS Defence Summit in Prague. The attack utilizes a malicious PIF file masquerading as summit documents, which drops SFFWallpaperCore.exe and libemb.dll. The ma…

Published: September 5, 2024

Downloadable IOCs: 4

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

A variant of WikiLoader loader for rent, also known as WailingCrab, is being delivered via SEO poisoning and spoofing of GlobalProtect VPN software. The campaign primarily affects U.S. higher education and transportation sectors. The infection chain involves multiple stages, including DLL sideloadi…

Published: September 2, 2024

Downloadable IOCs: 46

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

Kaspersky detected an ongoing targeted cyberattack campaign, dubbed EastWind, targeting Russian government organizations and IT companies. The attackers employed phishing emails with malicious shortcuts to deliver malware that communicated via Dropbox. They utilized tools associated with APT31 and …

Published: August 14, 2024

Downloadable IOCs: 5

GoTo Meeting loads RAT via Shellcode Loader

A malicious campaign has been discovered that exploits the legitimate GoTo Meeting online conferencing software to deploy the Remcos remote access trojan (RAT). The attack chain involves utilizing lures like porn downloads, software setup files, and tax forms with Russian and English file names. It…

Published: May 13, 2024

Downloadable IOCs: 17

Tag: dll sideloading

Attack reports

Illusory Wishes: China-nexus APT Targets the Tibetan Community

SOC files: an APT41 attack on government IT services in Africa

Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

June 2025 Infostealer Trend Report

UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

Applications of Snake Keylogger in Geopolitics: Abuse of Trusted Java Utilities in Cybercriminal Activities

May 2025 Infostealer Trend Report

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Custom Arsenal Developed to Target Multiple Industries

Targeting Taiwan & Japan with DLL Implants

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

Finding Minhook in a sideloading attack – and Sweden too

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Stealers and backdoors are spreading under the guise of a DeepSeek client

Operation SalmonSlalom

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Python-Based NodeStealer Version Targets Facebook Ads Manager

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

Threat Actor Targets Manufacturing Industry With Malware

RobotDropper Automates the Delivery of Multiple Infostealers

HijackLoader evolution: abusing genuine signing certificates

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

GoTo Meeting loads RAT via Shellcode Loader