Skip to content
Today
Sign in

Topic

DLL side-loading into trusted agents

A technique placing a malicious DLL where a signed application searches first, so it unknowingly loads and runs attacker code under its trust.

Sign in to follow

Current stories

securityConfirmed3 publishers

SLEEPWALKER: a backdoor that ships its own 23-instruction language, and nothing to block until it wakes

Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.

Publishers:r136a1.dev scworld.com thehackernews.com

Perspective Coverage

3 publishers
Builder
Builder 43%
Operator
Operator 52%
Investor
Investor 5%

Reality

Evidence58
Adoption10
Hype gap+6
Incentives35
Confidence68
securityConfirmed5 publishers

FamousSparrow replaced SparrowDoor with SparroWocky in a year of Latin American intrusions

ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.

Publishers:bleepingcomputer.com infosecurity-magazine.com thehackernews.com therecord.media welivesecurity.com

Perspective Coverage

5 publishers
Builder
Builder 22%
Operator
Operator 68%
Investor
Investor 10%

Reality

Evidence70
Adoption
Insufficient
Hype gap+5
Incentives
Insufficient
Confidence68
securityConfirmed4 publishers

Rapuncel ships a Microsoft-attested kernel driver built to terminate 145 security products

LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.

Publishers:scworld.com securityaffairs.com securityweek.com thehackernews.com

Perspective Coverage

4 publishers
Builder
Builder 27%
Operator
Operator 64%
Investor
Investor 9%

Reality

Evidence68
Adoption
Insufficient
Hype gap+15
Incentives40
Confidence70
buildOne report1 publisher

TA4922 parks Donut Loader in the same folder as a signed executable

Proofpoint's PackClient writeup describes a chain whose only attacker-supplied executable on disk is a DLL, and whose persistence arrives as a real ManageEngine agent. That leaves the detection sitting on load-event correlation and egress control.

Publishers:dev.to

Reality

Evidence36
Adoption31
Hype gap+14
Incentives57
Confidence41