Loading story…
A proof-of-concept showed that Internet Explorer on Windows attempts to load a missing DLL named suspend.dll, creating an opportunity for DLL hijacking persistence. Using Process Monitor (Procmon) to trace iexplore.exe, the researcher observed the failed DLL lookup, then built a replacement C++ DLL that executed code when the browser launched while allowing Internet Explorer to continue running normally. The demonstration reportedly also worked on Windows 11 x64.
The technique relies on placing a malicious suspend.dll in Internet Explorer's load path so it is loaded automatically each time the browser starts, giving attackers a simple persistence mechanism. Microsoft describes Process Monitor as a Sysinternals utility for real-time visibility into file system, Registry, and process activity, and the tool's filtering and event-capture capabilities were central to identifying the missing dependency and validating the hijack path for defender awareness and malware hunting.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A proof-of-concept post demonstrated a persistence technique against Internet Explorer by identifying that iexplore.exe attempts to load a missing suspend.dll and replacing it with a malicious DLL. The renamed DLL executed when Internet Explorer launched while the browser continued to function normally, and the author reported the technique also worked on Windows 11 x64.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows attackers have used **Component Object Model (COM) hijacking** to gain persistence by altering Registry entries so legitimate applications load attacker-controlled code during normal execution. MITRE documents the technique as `T1546.015`, noting that adversaries can replace COM object references or abuse **TypeLib** keys to redirect execution to malicious DLLs, scripts, or even remotely hosted payloads via the `script:` moniker. The approach is designed to survive reboots while blending into routine system activity, especially when attackers choose COM objects that are invoked often enough to ensure execution but not so critical that failures immediately expose the compromise. Public examples show both proof-of-concept and criminal use. A technical walkthrough demonstrated creating a user-level `HKCU\Software\Classes\CLSID\{...}\InprocServer32` entry so a process such as **Firefox** would load a malicious DLL instead of falling back to system-wide COM registrations, illustrating how COM hijacking can provide persistence and defense evasion. In the wild, the **W32.Silon** banking trojan reportedly replaced a CLSID reference for Microsoft-signed `msimtf.dll` with a malicious `msjet51.dll`, causing **Internet Explorer** to load the payload, steal online banking credentials, hide artifacts, and exfiltrate captured data to command-and-control servers.
Aug 15, 2026
Researchers published proof-of-concept Windows persistence techniques that abuse registry-controlled DLL load paths to force trusted processes to load attacker-controlled libraries. One method modifies `HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000007` by changing the `LibraryPath` value, causing socket-using applications such as **Microsoft Edge** to load a malicious DLL when launched; the demonstration on Windows 11 x64 required administrative privileges and used a benign message-box payload. A related earlier technique targeted `HKLM\Software\Microsoft\Cryptography\Offload`, where setting `ExpoOffload` to a rogue DLL reportedly caused cryptography-related processes including `svchost.exe` to load it.
Aug 15, 2026
Researchers published a detailed analysis and proof-of-concept exploit for **Microsoft bulletin `MS16-063`**, showing how a flaw in Internet Explorer's `jscript9.dll` can be turned into code execution on **Internet Explorer 11 running Windows 7**. The vulnerability stems from improper handling of detached `ArrayBuffer` objects in `TypedArray` and `DataView` operations, creating a **use-after-free** condition when functions such as `DirectGetItem`, `DirectSetItem`, `GetValue`, and `SetValue` access freed backing memory after an `ArrayBuffer` is detached via `postMessage`. The published research describes an exploitation path that converts the bug into arbitrary read/write primitives and then into shellcode execution through heap manipulation, a fake virtual function table, ROP, and `VirtualProtect`. A companion GitHub repository released a public HTML proof of concept that can be served over HTTP and opened in a vulnerable browser, although the authors noted it is not fully reliable. The researchers also reported that the demonstrated technique does not work on **Windows 8.1 and later** because **Control Flow Guard** blocks the indirect-call method used in the exploit.
Jul 24, 2026