SecuriTricks - dll sideloading

DeedRAT: Unpacking a Modern Backdoor's Playbook

DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creatio…

backdoor

apt

Published: December 31, 2025

Downloadable IOCs: 4

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to concea…

ransomware

dll sideloading

domain spoofing

initial access broker

Published: December 10, 2025

Downloadable IOCs: 3

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

A new campaign is distributing the Oyster (Broomstick) backdoor through trojanized Microsoft Teams installers. Threat actors are using SEO poisoning and malvertising to trick users into downloading fake installers from spoofed websites. The malicious installers deploy a persistent backdoor that ena…

Published: October 2, 2025

Downloadable IOCs: 15

Nimbus Manticore Deploys New Malware Targeting Europe

The Iranian threat actor Nimbus Manticore has expanded its operations, targeting defense, telecommunications, and aviation sectors in Western Europe. The group uses sophisticated spear-phishing techniques, impersonating HR recruiters to lure victims to fake career portals. Their toolset includes th…

Published: September 22, 2025

Downloadable IOCs: 81

Suspected APT-C-00 Delivers Havoc Trojan

A recent analysis of a suspicious trojan loader reveals similarities to the APT-C-00 (Ocean Lotus) group, a government-backed hacker organization targeting East Asian companies and government agencies. The sample, a DLL file with excellent evasion capabilities, uses hash algorithms to dynamically o…

Published: September 22, 2025

Downloadable IOCs: 0

August 2025 Infostealer Trend Report

This analysis examines Infostealer trends in August 2025, focusing on distribution volume, methods, and disguises. AhnLab's automated systems collect and analyze malware, providing real-time IOC services. Infostealers, often disguised as cracks, are distributed through SEO poisoning. Notable varian…

Published: September 16, 2025

Downloadable IOCs: 0

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core compone…

eggstremereflectiveloader

Published: September 10, 2025

Downloadable IOCs: 12

From SharePoint Vulnerability Exploit to Enterprise Ransomware

The Warlock ransomware group exploited unpatched Microsoft SharePoint servers to gain initial access and deploy ransomware across enterprise environments. The attack chain involved exploiting vulnerabilities, privilege escalation through Group Policy modification, credential theft using Mimikatz, l…

Published: August 20, 2025

Downloadable IOCs: 0

SOC files: an APT41 attack on government IT services in Africa

Kaspersky's MDR team detected a targeted attack by APT41 against government IT services in Africa. The attackers used Impacket tools, Cobalt Strike, and custom agents for lateral movement and data collection. They leveraged DLL sideloading techniques and publicly available tools like Mimikatz and R…

credential harvesting

Published: August 20, 2025

Downloadable IOCs: 0

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

The Noodlophile Stealer, first detailed in our previous analysis (New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms), has evolved into a highly targeted threat exploiting enterprises with significant Facebook footprints.

Published: August 19, 2025

Downloadable IOCs: 28

Supply Chain Risk in Python: Termcolor and Colorama Explained

A suspicious Python package named termncolor was discovered, which imports a malicious dependency called colorinal. This multi-stage malware operation leverages DLL sideloading to decrypt payloads, establish persistence, and conduct command-and-control communication, ultimately leading to remote co…

Published: August 16, 2025

Downloadable IOCs: 0

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction tec…

Published: August 12, 2025

Downloadable IOCs: 0

SLOW#TEMPEST Cobalt Strike Loader

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embed…

Published: August 7, 2025

Downloadable IOCs: 9

Unmasking LockBit: A Deep Dive into DLL Sideloading and Masquerading Tactics

This analysis explores the sophisticated tactics employed by LockBit ransomware attackers, focusing on DLL sideloading and masquerading techniques. These methods allow attackers to evade detection and maximize impact. DLL sideloading involves tricking legitimate applications into loading malicious …

Published: August 1, 2025

Downloadable IOCs: 11

GOLD BLADE remote DLL sideloading attack deploys RedLoader

A new infection chain for GOLD BLADE's RedLoader malware has been identified, combining previously separate techniques. The attack begins with a malicious PDF link, leading to a ZIP archive containing a LNK file masquerading as a PDF. This file executes conhost.exe, which uses WebDAV to contact a C…

Published: July 31, 2025

Downloadable IOCs: 5

Illusory Wishes: China-nexus APT Targets the Tibetan Community

Two cyberattack campaigns, Operation GhostChat and Operation PhantomPrayers, targeted the Tibetan community in June 2025, coinciding with the Dalai Lama's 90th birthday. These attacks involved strategic web compromises, DLL sideloading, and multi-stage infection chains to deploy Ghost RAT and Phant…

Published: July 23, 2025

Downloadable IOCs: 26

Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

In late 2024, a new variant of the SLOW#TEMPEST malware campaign was discovered, employing sophisticated obfuscation techniques. The malware is distributed as an ISO file containing multiple files, including a malicious loader DLL and a payload embedded in another DLL. The loader uses DLL side-load…

obfuscated function calls

Published: July 16, 2025

Downloadable IOCs: 0

June 2025 Infostealer Trend Report

This analysis provides insights into Infostealer malware trends observed in June 2025. The data, collected through various automated systems, reveals changes in distribution methods and malware types. While LummaC2 has been dominant, June saw increased activity from Rhadamanthys, ACRStealer, Vidar,…

anti-analysis techniques

Published: July 16, 2025

Downloadable IOCs: 0

UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered

UNG0002, an espionage-focused threat group, has been conducting campaigns across Asian jurisdictions including China, Hong Kong, and Pakistan. The group employs sophisticated multi-stage attacks using LNK files, VBScript, and custom RAT implants. Their operations span two major campaigns: Operation…

Published: July 16, 2025

Downloadable IOCs: 16

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

A cluster of suspicious activity, tracked as CL-STA-1020, has been targeting governmental entities in Southeast Asia since late 2024. The threat actors have developed a new Windows backdoor called HazyBeacon, which uses AWS Lambda URLs for command and control communication. This technique leverages…

governmental entities

hazybeacon

Published: July 14, 2025

Downloadable IOCs: 7

Applications of Snake Keylogger in Geopolitics: Abuse of Trusted Java Utilities in Cybercriminal Activities

A new phishing campaign using Snake Keylogger, a Russian-origin stealer, has been discovered targeting various victims including corporations, governments, and individuals. The campaign uses spear-phishing emails offering petroleum products, with malicious attachments exploiting the legitimate jsad…

Published: July 6, 2025

Downloadable IOCs: 0

May 2025 Infostealer Trend Report

This analysis examines the distribution trends of Infostealer malware in May 2025. It highlights the use of SEO poisoning to distribute malware disguised as cracks and keygens. LummaC2, Vidar, StealC, Rhadamanthys, and Amadey were the main Infostealers observed. Distribution methods included posts …

Published: June 18, 2025

Downloadable IOCs: 3

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…

asset lighthouse system

ipfuscation

callback-execution

dll-sideloading

Published: June 7, 2025

Downloadable IOCs: 0

Custom Arsenal Developed to Target Multiple Industries

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and Bypass…

vulnerability exploitation

brute ratel

multi-industry targeting

Published: May 27, 2025

Linked vulnerabilities : CVE-2024-9047 (CVSS 9.8), CVE-2024-51378 (CVSS 10.0), CVE-2024-51567 (CVSS 10.0), CVE-2024-56145, CVE-2025-31324 (CVSS 10.0), CVE-2017-9805, CVE-2024-27199, CVE-2024-27198, CVE-2021-22205

Downloadable IOCs: 185

Targeting Taiwan & Japan with DLL Implants

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads.…

Published: May 12, 2025

Downloadable IOCs: 16

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strik…

Published: May 2, 2025

Downloadable IOCs: 2

Finding Minhook in a sideloading attack – and Sweden too

A threat actor campaign targeting multiple locations was observed in late 2023 and early 2024. Initially focused on the Far East, it later shifted to Sweden. The attacks used DLL sideloading techniques, employing the Minhook library to detour Windows API calls. The clean loader was obtained from in…

Published: May 1, 2025

Downloadable IOCs: 0

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

A campaign targeting users in Ukraine with malicious LNK files has been observed since November 2024. The files, using Russian words related to troop movements as lures, run a PowerShell downloader contacting geo-fenced servers in Russia and Germany. The second stage payload uses DLL side loading t…

Published: March 28, 2025

Downloadable IOCs: 0

Stealers and backdoors are spreading under the guise of a DeepSeek client

Cybercriminals are exploiting the popularity of DeepSeek, a powerful reasoning large language model, by creating fake websites that mimic the official DeepSeek chatbot site and distribute malicious code disguised as a client. Three main schemes were identified: a Python stealer targeting user data …

Published: March 6, 2025

Downloadable IOCs: 9

Operation SalmonSlalom

A sophisticated cyberattack targeting industrial organizations in the Asia-Pacific region has been uncovered. The attackers utilized legitimate Chinese cloud services and a multi-stage payload delivery framework to evade detection. The campaign, named SalmonSlalom, employed techniques such as nativ…

Published: February 26, 2025

Downloadable IOCs: 160

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 researchers have discovered connections between Stately Taurus, a threat actor targeting ASEAN countries, and the Bookworm malware family. Analysis of infrastructure and code overlaps revealed links between recent Stately Taurus attacks and Bookworm samples dating back to 2015. The group ha…

infrastructure overlap

bookworm

Published: February 20, 2025

Downloadable IOCs: 0

Python-Based NodeStealer Version Targets Facebook Ads Manager

The latest variant of NodeStealer has evolved from JavaScript to Python, expanding its data theft capabilities. Trend Micro's MXDR team uncovered this advanced version in a campaign targeting a Malaysian educational institution, linked to a Vietnamese threat group. The malware now targets Facebook …

Published: December 19, 2024

Downloadable IOCs: 5

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

The FLUX#CONSOLE campaign involves a sophisticated tax-themed phishing attack that exploits Microsoft Management Console (MSC) files to deliver a stealthy backdoor payload. Threat actors use tax-related lures to trick users into executing malicious code. The attack leverages MSC files, which are no…

Published: December 18, 2024

Downloadable IOCs: 5

Threat Actor Targets Manufacturing Industry With Malware

A sophisticated cyberattack campaign targeting the manufacturing industry has been identified, utilizing a deceptive LNK file disguised as a PDF document. The attack leverages multiple Living-off-the-Land Binaries and Google Accelerated Mobile Pages to evade detection. The threat actor employs vari…

Published: December 5, 2024

Downloadable IOCs: 0

RobotDropper Automates the Delivery of Multiple Infostealers

A phishing campaign is distributing Trojanized MSI files that use DLL sideloading to execute LegionLoader, a malicious program that delivers multiple infostealers. The campaign is widespread, with over 400 unique malicious MSI files identified since June 2024. Victims are targeted globally through …

Published: November 26, 2024

Downloadable IOCs: 5

HijackLoader evolution: abusing genuine signing certificates

A report by HarfangLab EDR and MITRE ATT&CK on the threat posed by the Lumma Stealer malware, published on 11 October, 2024, outlines the tactics used to deploy the malware.

Published: October 15, 2024

Downloadable IOCs: 69

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

A cyber espionage campaign using the ToneShell backdoor, associated with Mustang Panda, has been detected targeting attendees of the 2024 IISS Defence Summit in Prague. The attack utilizes a malicious PIF file masquerading as summit documents, which drops SFFWallpaperCore.exe and libemb.dll. The ma…

Published: September 5, 2024

Downloadable IOCs: 4

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

A variant of WikiLoader loader for rent, also known as WailingCrab, is being delivered via SEO poisoning and spoofing of GlobalProtect VPN software. The campaign primarily affects U.S. higher education and transportation sectors. The infection chain involves multiple stages, including DLL sideloadi…

Published: September 2, 2024

Downloadable IOCs: 46

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

Kaspersky detected an ongoing targeted cyberattack campaign, dubbed EastWind, targeting Russian government organizations and IT companies. The attackers employed phishing emails with malicious shortcuts to deliver malware that communicated via Dropbox. They utilized tools associated with APT31 and …

Published: August 14, 2024

Downloadable IOCs: 5

GoTo Meeting loads RAT via Shellcode Loader

A malicious campaign has been discovered that exploits the legitimate GoTo Meeting online conferencing software to deploy the Remcos remote access trojan (RAT). The attack chain involves utilizing lures like porn downloads, software setup files, and tax forms with Russian and English file names. It…

Published: May 13, 2024

Downloadable IOCs: 17

Tag: dll sideloading

Attack reports

DeedRAT: Unpacking a Modern Backdoor's Playbook

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

Inside Shanya, a packer-as-a-service fueling modern attacks

Operation Hanoi Thief: Vietnam APT

A Closer Look at Outlook Macros and More

Watch out for SVG files booby-trapped with malware

China-linked Actors Maintain Focus on Organizations Influencing U.S. Policy

Jewelbug: Chinese APT Group Widens Reach to Russia

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

Nimbus Manticore Deploys New Malware Targeting Europe

Suspected APT-C-00 Delivers Havoc Trojan

August 2025 Infostealer Trend Report

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

From SharePoint Vulnerability Exploit to Enterprise Ransomware

SOC files: an APT41 attack on government IT services in Africa

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

Supply Chain Risk in Python: Termcolor and Colorama Explained

New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises

SLOW#TEMPEST Cobalt Strike Loader

Unmasking LockBit: A Deep Dive into DLL Sideloading and Masquerading Tactics

GOLD BLADE remote DLL sideloading attack deploys RedLoader

Illusory Wishes: China-nexus APT Targets the Tibetan Community

Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

June 2025 Infostealer Trend Report

UNG0002 (Unknown Group 0002): Espionage Campaigns Uncovered

Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication

Applications of Snake Keylogger in Geopolitics: Abuse of Trusted Java Utilities in Cybercriminal Activities

May 2025 Infostealer Trend Report

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Custom Arsenal Developed to Target Multiple Industries

Targeting Taiwan & Japan with DLL Implants

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

Finding Minhook in a sideloading attack – and Sweden too

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Stealers and backdoors are spreading under the guise of a DeepSeek client

Operation SalmonSlalom

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Python-Based NodeStealer Version Targets Facebook Ads Manager

Analyzing FLUX#CONSOLE: Using Tax-Themed Lures, Threat Actors Exploit Windows Management Console to Deliver Backdoor Payloads

Threat Actor Targets Manufacturing Industry With Malware

RobotDropper Automates the Delivery of Multiple Infostealers

HijackLoader evolution: abusing genuine signing certificates

Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

GoTo Meeting loads RAT via Shellcode Loader