DLL Sideloading Archives • Daily CyberSecurity

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users malware-code

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users

Do Son August 7, 2026

At a Glance Attribute Detail Malware family FDMTP implant (.NET, TouchSocket-based) Threat actor Suspected Twill Typhoon (not...

OctLurk and SilkLurk backdoors targeting Central Asian government espionage campaign

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

Do Son August 5, 2026

At a glance Field Detail Malware family OctLurk (plugin-based backdoor); SilkLurk (plugin-based backdoor); LurkProxy (network proxy utility)...

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools

Do Son July 31, 2026

At a Glance Actor / group SilverFox (Silver Fox), a China-aligned APT tracked since about 2022 Activity...

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools

Do Son July 28, 2026

At a Glance Actor or group JadeProx, a China-nexus cluster named by Group-IB; no known group named...

TELESHIM Malware Targets Middle East Governments Through Telegram SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

TELESHIM Malware Targets Middle East Governments Through Telegram

Do Son July 27, 2026

At a glance Threat actor Unnamed group with links to East Asia (moderate-to-high confidence) Activity type Targeted...

Foxit PDF Reader vulnerability CVE-2026-57239 exploited for SYSTEM privileges via local privilege escalation

CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges

Do Son July 23, 2026

TL;DR A security researcher has published full details and proof-of-concept code for a Foxit PDF Reader vulnerability....

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious...

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks

Do Son July 6, 2026

At a glance Details Malware family ValleyRAT (Remote Access Trojan) Threat actor Often linked to SilverFox; attribution...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

At a glance Field Detail Malware family SharkLoader (loader) delivering Cobalt Strike Beacon Threat actor StrikeShark; unattributed,...

Khmer Shadow Espionage Campaign Targets Cambodian Government hack

Khmer Shadow Espionage Campaign Targets Cambodian Government

Do Son June 18, 2026

Acronis Threat Research Unit has uncovered a previously unreported Khmer Shadow espionage campaign that uses a custom...

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks

Do Son June 10, 2026

Severe Infrastructure Exposure Discovered Cybercriminals are constantly finding clever ways to exploit standard corporate workflows. Recently, a...

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks Twill Typhoon RAT campaign DLL side loading tradecraft

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Do Son June 2, 2026

A stealthy cyber espionage operation is actively targeting organizations across the Asia-Pacific region. Specifically, security researchers recently...

Legitimate Software Abused: Stealthy ValleyRAT Malware Campaign Targets Enterprise Users

Do Son May 24, 2026

A dangerous new ValleyRAT malware campaign is currently targeting unsuspecting corporate users across the internet. Specifically, threat...

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks Twill Typhoon DLL Sideloading

Twill Typhoon Exploits CDN Masquerading and DLL Sideloading to Breach APJ Networks

Do Son May 22, 2026

A sophisticated, highly targeted cyber-espionage campaign is actively penetrating corporate and critical infrastructure networks across the Asia-Pacific...

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

FamousSparrow Deed RAT ProxyNotShell Exchange Exploitation

Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure

Do Son May 19, 2026

A relentless cyber-espionage operation has targeted an Azerbaijani oil and gas company, demonstrating that advanced persistent threats...

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Stealth & Automation: Seedworm’s 2026 Global Campaign Hijacks Security Software to Deploy ChromElevator

Do Son May 15, 2026

A sprawling espionage campaign linked to the Iranian state has been uncovered, revealing a significant evolution in...

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning Lorem Ipsum Malware Microsoft Teams SEO Poisoning

“Lorem Ipsum” Loader Weaponizing Microsoft Teams via SEO Poisoning

Do Son May 12, 2026

A new and operationally disciplined threat actor has emerged, demonstrating just how quickly a “mid-tier” criminal group...

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

TrendAI Research has identified a persistent and methodical China-aligned threat cluster targeting government entities and critical infrastructure...

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot Mustang Panda LOTUSLITE Financial Cyber-Espionage

The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot

Do Son April 23, 2026

The Acronis Threat Research Unit (TRU) has identified a significant shift in the operations of Mustang Panda,...

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts JanelaRAT LATAM Banking Malware

JanelaRAT Uses Fake Windows Updates to Empty LATAM Bank Accounts

Do Son April 15, 2026

In the diverse ecosystem of Latin American cybercrime, one threat continues to refine its ability to peer...

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan CVE-2023-22952 CPUID Watering Hole DLL Sideloading

The CPUID Watering Hole Attack Turning CPU-Z into a Trojan

Do Son April 13, 2026

In the world of system administration, few tools are as ubiquitous as CPU-Z and HWMonitor. These utilities...