DLL Sideloading Archives • Daily CyberSecurity

CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges

Foxit PDF Reader vulnerability CVE-2026-57239 exploited for SYSTEM privileges via local privilege escalation

CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges

Do Son July 23, 2026

TL;DR A security researcher has published full details and proof-of-concept code for a Foxit PDF Reader vulnerability....

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious...

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks

Do Son July 6, 2026

At a glance Details Malware family ValleyRAT (Remote Access Trojan) Threat actor Often linked to SilverFox; attribution...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

At a glance Field Detail Malware family SharkLoader (loader) delivering Cobalt Strike Beacon Threat actor StrikeShark; unattributed,...

Khmer Shadow Espionage Campaign Targets Cambodian Government hack

Khmer Shadow Espionage Campaign Targets Cambodian Government

Do Son June 18, 2026

Acronis Threat Research Unit has uncovered a previously unreported Khmer Shadow espionage campaign that uses a custom...

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks

Do Son June 10, 2026

Severe Infrastructure Exposure Discovered Cybercriminals are constantly finding clever ways to exploit standard corporate workflows. Recently, a...

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks Twill Typhoon RAT campaign DLL side loading tradecraft

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Do Son June 2, 2026

A stealthy cyber espionage operation is actively targeting organizations across the Asia-Pacific region. Specifically, security researchers recently...

Legitimate Software Abused: Stealthy ValleyRAT Malware Campaign Targets Enterprise Users

Do Son May 24, 2026

A dangerous new ValleyRAT malware campaign is currently targeting unsuspecting corporate users across the internet. Specifically, threat...

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks Twill Typhoon DLL Sideloading

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks

Do Son May 22, 2026

A sophisticated, highly targeted cyber-espionage campaign is actively penetrating corporate and critical infrastructure networks across the Asia-Pacific...

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure

Do Son May 19, 2026

A relentless cyber-espionage operation has targeted an Azerbaijani oil and gas company, demonstrating that advanced persistent threats...

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator

Do Son May 15, 2026

A sprawling espionage campaign linked to the Iranian state has been uncovered, revealing a significant evolution in...

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning Lorem Ipsum Malware Microsoft Teams SEO Poisoning

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning

Do Son May 12, 2026

A new and operationally disciplined threat actor has emerged, demonstrating just how quickly a “mid-tier” criminal group...

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

TrendAI Research has identified a persistent and methodical China-aligned threat cluster targeting government entities and critical infrastructure...

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot Mustang Panda LOTUSLITE Financial Cyber-Espionage

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot

Do Son April 23, 2026

The Acronis Threat Research Unit (TRU) has identified a significant shift in the operations of Mustang Panda,...

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts JanelaRAT LATAM Banking Malware

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts

Do Son April 15, 2026

In the diverse ecosystem of Latin American cybercrime, one threat continues to refine its ability to peer...

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan CVE-2023-22952 CPUID Watering Hole DLL Sideloading

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan

Do Son April 13, 2026

In the world of system administration, few tools are as ubiquitous as CPU-Z and HWMonitor. These utilities...

LinkedIn Job Seekers Targeted by Sophisticated “PXA Stealer” Campaign PXA Stealer LinkedIn Job Phishing

LinkedIn Job Seekers Targeted by Sophisticated “PXA Stealer” Campaign

Do Son April 10, 2026

A sophisticated, financially motivated threat campaign is currently sweeping across professional networks, specifically targeting job seekers on...

Blitz Brigantine Weaponizes Email Bombing and DNS MX Records to Deploy AOBackdoor Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Cemu emulator Linux malware Blitz Brigantine AOBackdoor GitHub Malware Campaign StealC Infostealer TamperedChef Malware, SEO Poisoning Carbanak malware RubyGems Supply Chain, Infostealer

Blitz Brigantine Weaponizes Email Bombing and DNS MX Records to Deploy AOBackdoor

Do Son March 16, 2026

Cybersecurity experts at BlueVoyant have uncovered a sophisticated evolution in the tactics of the threat group known...

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

Lotus Wiper Digital Sabotage G_Wagon Malware NPM Supply Chain Attack IMAPLoader malware ResolverRAT Malware Evasion

The High Cost of ‘Free’: How PiviGames Became a Lovecraftian Malware Hub for HijackLoader and ACRStealer

Do Son March 3, 2026

In the world of PC gaming, the lure of “free” pirated content has always carried risks. However,...

Dohdoor: New Stealth Backdoor Targets US Healthcare and Education Dohdoor Backdoor UAT-10027

Dohdoor: New Stealth Backdoor Targets US Healthcare and Education

Do Son March 2, 2026

A sophisticated cyber espionage campaign has been quietly infiltrating the United States education and healthcare sectors for...

New CRESCENTHARVEST Malware Targets Iranian Dissidents Zyxel security - Mitel MiCollab Vulnerability

New CRESCENTHARVEST Malware Targets Iranian Dissidents

Do Son February 18, 2026

A new cyber espionage campaign is exploiting the political unrest in Iran to target dissidents and supporters...