🎯 Reflective DLL loading

The items that name it 3

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeup2026-09-09

  Reflectively loaded DLLs (p1 for host fingerprinting/reconnaissance, p2 for running the kernel LPE exploit) loaded in-memory without touching disk as part of the BlueMoon chain.

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeup2026-06-16

  Potemkin and RMMProject's module loader parse PE headers, map sections, fix up relocations, and resolve imports entirely in memory without calling LoadLibrary, then invoke an export (TLSDataStart).

• ELearnSecurity Certified Threat Hunting Professional (eCTHPv2) review
  article2022-07-10

  Attack technique covered for endpoint threat hunting detection