Loading story…
Resecurity reported on PDFSIDER, a newly identified Windows backdoor distributed via spear-phishing that delivers a ZIP containing a legitimate, validly signed PDF24 Creator executable alongside a malicious cryptbase.dll. When the victim runs the trusted PDF24 binary, DLL side-loading causes the fake cryptbase.dll to load, triggering covert backdoor execution with minimal user-visible artifacts and strong evasion features (e.g., anti-VM/anti-debug checks and in-memory behavior).
The malware implements encrypted command-and-control using an embedded Botan cryptographic library and AES-256-GCM, enabling interactive remote command execution and system reconnaissance while reducing detection opportunities. Reporting indicates PDFSIDER’s C2 can be tunneled over DNS (port 53) and that the tooling is already being leveraged by multiple threat actors, including ransomware operators, as a stealthy payload loader; Resecurity stated it was identified during an attempted intrusion against a Fortune 100 organization that was disrupted before data loss occurred.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Resecurity assessed that PDFSIDER was already being used by multiple ransomware actors, including observed use in Qilin attacks, while also noting the tooling looked more espionage-oriented than typical crimeware. The report further cited moderate-confidence overlap with Mustang Panda-style tradecraft and decoy documents impersonating PLA intelligence authorship.
Researchers disclosed that PDFSIDER communicated with attacker infrastructure over DNS on port 53 and protected command-and-control traffic with Botan and AES-256-GCM authenticated encryption. The malware also assigned unique host IDs, exfiltrated command output, and maintained covert long-term access with minimal disk artifacts.
Resecurity reported that the PDFSIDER-related intrusion against the Fortune 100 enterprise was stopped before data loss occurred. The finding came from the company's incident response and prevented-intrusion investigation.
Resecurity identified a new malware variant dubbed PDFSIDER that abused DLL side-loading by pairing a legitimate signed PDF24 executable with a malicious fake cryptbase.dll. The malware operated largely in memory, performed host reconnaissance, enabled hidden remote shell access, and used anti-VM and debugger checks to evade analysis.
During an intrusion attempt against a Fortune 100 company in the finance or energy sector, attackers impersonated technical support to persuade employees to install Microsoft Quick Assist for remote access. The same activity also used spear-phishing emails with ZIP archives to deliver the malware chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceresecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple malware campaigns that disguised executables as document files to trick users into launching backdoors. In one case, attackers used a file named **"2021년 국방부 업무보고 수정.pif"** that appeared to be a revised South Korean Ministry of National Defense report; when opened, it displayed a legitimate PDF while silently dropping a malicious DLL to `C:\ProgramData\Intel\Driver\driver.cfg`, executing it with **`regsvr32.exe`**, and creating a scheduled task named **`Disk0`** to run every 30 minutes. The payload was identified as a downloader that contacted command-and-control infrastructure for follow-on instructions. A separate campaign used a malicious **SCR** file signed with a valid certificate from a well-known Korean company and presented with a PDF-like icon to reduce suspicion. After execution, the malware opened a decoy PDF from `%TEMP%`, extracted a DLL named `config.dat` into `C:\Users\Public\`, launched it with **`rundll32.exe`**, and deleted the original dropper. The backdoor then established persistence either through a **`MicrosoftEdgeInstaller`** service or a registry key, decrypted embedded configuration data with **RC4** when needed, and connected to its C2 server to support file transfer, process execution, screenshot capture, configuration updates, and code injection.
Aug 15, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026
Researchers reported overlapping malware campaigns that use fake or trojanized PDF reader packages to compromise Windows systems through **DLL sideloading**. Cisco Talos identified **PXA Stealer** targeting government and education organizations, while Beazley Security and SentinelLabs said the Python-based infostealer has operated at scale since late 2024, affecting more than **4,000 victims in 62 countries**. The activity has been linked to Vietnamese-speaking threat actors who used phishing, signed software such as **Haihaisoft PDF Reader** and **Microsoft Word 2013**, and multi-stage loaders to evade detection and establish persistence through Windows `Run` registry keys. The malware chains ultimately steal browser credentials, cookies, autofill data, cryptocurrency wallet contents, and other sensitive application data, with exfiltration routed through **Telegram bots** and **Cloudflare Workers** and ties observed to the **Sherlock** stolen-data marketplace. In a related development, Kroll said **XWORM** operators adopted a similar fake PDF reader delivery chain using **Ghost Crypt**, packaging a renamed Haihaisoft executable, a malicious DLL, and a decoy PDF in a ZIP archive. That infection path uses a "process hypnosis" technique to inject payloads into `csc.exe`, persists via `rundll32.exe`, and ends with a plugin-based RAT capable of information theft and ransomware-related actions.
Aug 14, 2026