🎯 DLL sideloading

The items that name it 13

• Camera Management Software Compromise Leads to Malware Deployment
  writeupas classification.key entities2026-10-27
• Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
  articleas techniques2026-10-19It is written here as DLL side-loading: attackers paired a legitimately signed Siemens Software Center copy with their own malicious DLLs, which the program loaded from its own folder.
• Investigating Ephemeral Supply Chain Tampering
  writeupas techniques2026-10-15

  NitroPromotion.exe sideloads Eztwain4.dll (ADAPTAGENT) from %LOCALAPPDATA%\Nitro Pro\

• Blinder Tunnel Campaign Targets Iraqi Infrastructure
  articleas classification.key entities2026-10-06
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  writeupas techniques2026-09-30

  Microsoft-signed GatherOsState.exe loads malicious slc.dll (Antino) from local directory

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeupas techniques2026-09-28It is written here as DLL sideloading (T1574.002).

  Legitimate signed apps (Canon's COTFileReadApp.exe, Stardock's DeElevate64.exe) load a trojanized companion DLL (ceiinfolog.dll / DeElevator64.dll) placed in the same folder, which in turn imports a malicious library (rdCore.dll) to execute attacker code.

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas techniques2026-09-28

  First-stage loader masquerades as a required DLL and is loaded through DLL sideloading alongside legitimate software

• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeupas techniques2026-09-17It is written here as DLL side-loading.

  Legitimate Windows binary bthudtask.exe copied to a spoofed path (C:\Windows \SysWOW64\ with trailing space) and executed to side-load a malicious DLL; spoofed directory then deleted.

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeupas techniques2026-09-09

  Used by UNK_LateNight (ShadowPad), UNK_DoubleCheck (Rust loader), and UNK_QuietRacket (GfExperienceService64.exe/GFExperienceUpdate.dll) to load malicious payloads via legitimate-looking executables paired with malicious DLLs.

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
  writeupas techniques2026-07-22

  Malicious DLLs (libcef.dll, tempdir.dll) placed alongside legitimate signed executables (jcef_helper.exe repurposed as ClaudeDesktop.exe/DockerDesktop.exe, and IBM SPSS's sslconf.exe) to achieve execution in a trusted process context.

• Unmasking an Attack Chain of MuddyWater
  writeupas techniques2026-03-06It is written here as DLL side-loading.

  Legitimate FMAPP.exe loads a malicious FMAPP.dll placed in the same folder (c:\Users\Public\Downloads\), which contains code that connects back to C2

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas techniques2025-12-03It is written here as DLL side-loading.

  Technique attributed to Storm-2603 for dropping loaders after web shell deployment on SharePoint servers, per the Singapore government security advisory

• Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
  articleas techniques

  Antino implant ('slc.dll') launched via DLL sideloading using the legitimate Microsoft-signed binary 'GatherOsState.exe'.