Loading malware…
1 distinct technique documented for this family, organized by ATT&CK tactic.
First, attackers plant a malicious file named wtsapi32.dll inside a ViPNet update folder. Then Windows starts, and the trusted update executable itcsrvup64.exe loads the rogue DLL. This DLL sideloading trick hands the attackers a quiet foothold.
First, attackers plant a malicious file named wtsapi32.dll inside a ViPNet update folder. Then Windows starts, and the trusted update executable itcsrvup64.exe loads the rogue DLL. This DLL sideloading trick hands the attackers a quiet foothold.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.