Loading story…
Security researchers published a proof-of-concept for remote function stomping, a Windows process-injection method that overwrites an existing exported API function inside another process and then runs the injected payload with a remote thread. The demonstration used notepad.exe as the target and selected CallMsgFilterA from user32.dll, resolving the function locally before modifying the remote process with VirtualProtectEx, writing shellcode through WriteProcessMemory, and triggering execution via CreateRemoteThread.
The write-up said the technique depends on the target DLL already being loaded in the remote process and noted that ASLR can affect DLL base addresses across processes. The authors presented the material as educational for malware researchers, red teams, and defenders, but the compiled sample was reportedly flagged as suspicious in an ANY.RUN sandbox, underscoring the detection and abuse potential of the method.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A technical blog post was published demonstrating remote function stomping on Windows, showing how shellcode can overwrite an exported API function in another process and be executed with a remote thread. The example used notepad.exe, user32.dll, CallMsgFilterA, and documented use of VirtualProtectEx, WriteProcessMemory, and CreateRemoteThread.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecocomelonc.github.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Process Parameter Poisoning (P³)**, a Windows code-injection technique that stages malicious payloads inside a newly created process by abusing data copied during `CreateProcessW`, including the command line, environment block, and `STARTUPINFO.lpReserved` fields. Instead of relying on heavily monitored APIs such as `WriteProcessMemory` and `VirtualAllocEx`, the technique locates attacker-controlled data through the target process’s **PEB** and `RTL_USER_PROCESS_PARAMETERS`, then prepares it for execution inside the remote process. A public proof of concept, **`p3-loader`** from Orange Cyberdefense, demonstrates redirecting the target process’s main thread with `NtSetContextThread` after changing memory protections, avoiding classic remote-thread creation and reducing common process-injection telemetry. SensePost reported that its implementation executed without alerts across four major EDR products even when process-injection protections were enabled, while both disclosures noted defender opportunities such as monitoring executable protections on process-parameter memory, anomalous process-creation parameters, remote reads of process parameters, and thread-context changes following protection updates.
Jul 8, 2026
Security researchers have highlighted advanced methods for analyzing and manipulating Windows binaries, focusing on both dynamic binary instrumentation (DBI) and DLL hijacking techniques. The use of open-source frameworks like DynamoRIO enables analysts to perform runtime analysis, reverse engineering, and security auditing of executables without access to source code. These tools are essential for malware analysis and can evade anti-analysis techniques, providing transparency and low performance impact during execution. Step-by-step guides and sample code are available to help researchers build their own DBI tools for Windows 11, demonstrating practical applications in security research. In parallel, researchers have explored persistence and privilege escalation techniques involving DLL hijacking in Windows accessibility features. By exploiting the way Narrator.exe loads specific DLLs, attackers with local administrator access can execute arbitrary code by placing malicious DLLs in targeted directories. This method, which has persisted despite being known for over a decade, allows code execution within the context of system processes, although it may require additional steps to suppress unwanted side effects such as the accessibility feature's voice output. These findings underscore the ongoing need for vigilance in monitoring both binary instrumentation and DLL loading behaviors on Windows systems.
Jun 29, 2026
Researchers reported that **Windows Subsystem for Linux 2 (WSL2)** can be abused to stage malware payloads while evading much of the visibility provided by Windows-native telemetry. Unlike WSL1, which maps Linux activity into the Windows process model, WSL2 runs a full Linux kernel inside a lightweight Hyper-V VM with its own process space, filesystem, and network stack. As a result, network activity initiated inside WSL2 may not appear in Windows tools such as Sysmon, creating a gap for defenders trying to reconstruct attacker behavior. The reporting shows that when a process inside WSL2 writes files into the Windows filesystem through `/mnt/c/`, the resulting activity is attributed on the Windows side to **`DllHost.exe`** via the Plan 9 (`9P`) proxy layer and `vp9fs.dll`, rather than to the originating Linux process. That split obscures the attack chain and turns payload staging into an indirect execution problem, although launching Windows binaries from WSL remains visible because normal Windows processes are created with **`wsl.exe`** as the parent. Defenders were advised to use outcome-based detections, including monitoring for unexpected **`wsl.exe`** execution and suspicious **`DllHost.exe`** creation of executable or script files in user-writable paths such as `Users\Public`, `ProgramData`, and `Windows\Temp`.
Jun 29, 2026