Loading story…
Security researchers have highlighted advanced methods for analyzing and manipulating Windows binaries, focusing on both dynamic binary instrumentation (DBI) and DLL hijacking techniques. The use of open-source frameworks like DynamoRIO enables analysts to perform runtime analysis, reverse engineering, and security auditing of executables without access to source code. These tools are essential for malware analysis and can evade anti-analysis techniques, providing transparency and low performance impact during execution. Step-by-step guides and sample code are available to help researchers build their own DBI tools for Windows 11, demonstrating practical applications in security research.
In parallel, researchers have explored persistence and privilege escalation techniques involving DLL hijacking in Windows accessibility features. By exploiting the way Narrator.exe loads specific DLLs, attackers with local administrator access can execute arbitrary code by placing malicious DLLs in targeted directories. This method, which has persisted despite being known for over a decade, allows code execution within the context of system processes, although it may require additional steps to suppress unwanted side effects such as the accessibility feature's voice output. These findings underscore the ongoing need for vigilance in monitoring both binary instrumentation and DLL loading behaviors on Windows systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published a technical tutorial on building dynamic binary instrumentation tooling with DynamoRIO on Windows 11, including setup guidance, sample clients, and use of drmgr and drwrap. The post also documented testing against a non-malicious "Anti-X" sample and noted an observed TLS-related failure on very recent Intel mobile CPUs that was under investigation.
TrustedSec published a blog post titled "Hack-cessibility: When DLL Hijacks Meet Windows Helpers." The reference provides no synopsis, so the observable event is the public release of the technical write-up.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that hunting for **unsigned DLLs** can uncover both commodity malware and advanced persistent threat activity that may evade behavior-based detections. The research found attackers commonly place malicious DLLs in unprivileged locations such as `ProgramData`, `AppData`, and user profile directories, then execute them through trusted Windows binaries including `rundll32.exe` and `regsvr32.exe`, or by abusing legitimate applications through DLL side-loading and search-order hijacking. Analysts said high-entropy files, scrambled names, rare execution patterns, and DLLs loaded from unusual paths are strong indicators for early detection. The report tied this technique to multiple threat clusters. **Stately Taurus** (Mustang Panda/PKPLUG) was observed using DLL search-order hijacking with `AvastSvc.exe` to load PlugX, while **Selective Pisces** (Lazarus Group) used `MagicLine4NX.exe`, `wsmprovhost.exe`, `mi.dll`, and a malicious `ualapi.dll` to maintain persistence. Unit 42 also linked frequent `rundll32.exe` and `regsvr32.exe` execution of DLLs from random `ProgramData` or `AppData` folders to **Raspberry Robin**, which typically starts from a malicious USB shortcut and later retrieves payloads through `msiexec.exe`.
Jun 29, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026
Security researchers published a proof-of-concept for **remote function stomping**, a Windows process-injection method that overwrites an existing exported API function inside another process and then runs the injected payload with a remote thread. The demonstration used `notepad.exe` as the target and selected `CallMsgFilterA` from `user32.dll`, resolving the function locally before modifying the remote process with `VirtualProtectEx`, writing shellcode through `WriteProcessMemory`, and triggering execution via `CreateRemoteThread`. The write-up said the technique depends on the target DLL already being loaded in the remote process and noted that **ASLR** can affect DLL base addresses across processes. The authors presented the material as educational for malware researchers, red teams, and defenders, but the compiled sample was reportedly flagged as **suspicious** in an ANY.RUN sandbox, underscoring the detection and abuse potential of the method.
Jul 16, 2026