Loading story…
Sophos reported that several intrusions involving DLL sideloading appear to be connected, indicating a broader campaign rather than isolated incidents. The cases relied on legitimate applications to load malicious dynamic-link libraries, a technique that helps attackers evade detection by blending malicious code execution with trusted software behavior.
The research suggests overlapping tradecraft, tooling, and operational patterns across the incidents, pointing to a potentially shared threat actor or closely related operators. By tying the cases together, Sophos highlighted DLL sideloading as a persistent intrusion method that can support stealthy malware deployment, lateral movement, and follow-on compromise inside targeted environments.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released research titled "Family Tree: DLL-Sideloading Cases May Be Related," describing its assessment that several DLL sideloading incidents may be connected. No additional incident dates or discrete underlying events are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that hunting for **unsigned DLLs** can uncover both commodity malware and advanced persistent threat activity that may evade behavior-based detections. The research found attackers commonly place malicious DLLs in unprivileged locations such as `ProgramData`, `AppData`, and user profile directories, then execute them through trusted Windows binaries including `rundll32.exe` and `regsvr32.exe`, or by abusing legitimate applications through DLL side-loading and search-order hijacking. Analysts said high-entropy files, scrambled names, rare execution patterns, and DLLs loaded from unusual paths are strong indicators for early detection. The report tied this technique to multiple threat clusters. **Stately Taurus** (Mustang Panda/PKPLUG) was observed using DLL search-order hijacking with `AvastSvc.exe` to load PlugX, while **Selective Pisces** (Lazarus Group) used `MagicLine4NX.exe`, `wsmprovhost.exe`, `mi.dll`, and a malicious `ualapi.dll` to maintain persistence. Unit 42 also linked frequent `rundll32.exe` and `regsvr32.exe` execution of DLLs from random `ProgramData` or `AppData` folders to **Raspberry Robin**, which typically starts from a malicious USB shortcut and later retrieves payloads through `msiexec.exe`.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Targeted intrusion campaigns used tampered **Microsoft-signed DLLs** to evade trust checks and launch malware through **DLL side-loading** and service hijacking. LAC researchers documented the **SigLoader** malware family modifying data in a file's certificate or overlay area while preserving Windows signature validation, allowing the DLL to still appear legitimately signed. The loader then decrypted and executed additional stages in memory using layered routines including **XOR**, custom **DES**, **AES**, and later **RC4**, with observed payloads including **DelfsCake**, **GreetCake**, and shellcode associated with **Metasploit Framework** or **Cobalt Strike**. In one case, the intrusion began with exploitation of an **SSL-VPN vulnerability** before the loader was deployed on a compromised endpoint. A related campaign assessed as likely tied to **APT41** used the same signed-DLL abuse technique to deliver **Cobalt Strike Beacon**, including a tampered `KBDTAM131.DLL` derived from `UXLibRes.dll` and malicious loading via the Windows **IKEEXT** service and `wlbsctrl.dll`. Researchers said the loader stored encrypted configuration data, API strings, offsets, and payload content with **ChaCha20**, then decrypted a Beacon linked to a leaked or cracked **Cobalt Strike 4.x** build using watermark `0x12345678` and C2 over **HTTPS**, with other samples using **HTTP** or **DNS**. The activity was also tied to a malicious shortcut file masquerading as a PDF, campaign infrastructure including `119.45.238[.]189` and `192.109.98[.]187`, and detection guidance using **Sigcheck**, **Autoruns**, Windows event logs, YARA rules, and stricter Authenticode verification.
Aug 15, 2026