DLL Sideloading Archives • Daily CyberSecurity

Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries

Yoba malware campaign and GitHub Yoba malware campaign attack chain diagram

Yoba Malware Campaign Sideloads Payloads Through Signed OpenAI and Anthropic Binaries

Do Son October 29, 2026

Check Point reveals the Yoba malware campaign. This GitHub Yoba malware campaign uses signed OpenAI and Anthropic binaries to sideload YobaLoader.

BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor

Do Son October 23, 2026

BRONZE SANDCASTLE uses Sandboxie DLL sideloading to run a modified Meterpreter backdoor in memory against targets in Asia and Africa.

Siemens Confirms Software Center Flaw CVE-2026-110936 Exploited in the Wild in ClickFix Attacks Siemens Software Center vulnerability CVE-2026-110936 exploited in the wild via DLL sideloading

Siemens Software Center vulnerability CVE-2026-110936 exploited in the wild via DLL sideloading

Siemens Confirms Software Center Flaw CVE-2026-110936 Exploited in the Wild in ClickFix Attacks

Do Son October 20, 2026

Siemens Software Center vulnerability CVE-2026-110936 is exploited in the wild by ClickFix attackers via DLL sideloading. Update to 4.0.9.8.

DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel DragonForce backdoor using Microsoft Teams TURN relays and MQTT as a fallback command channel

DragonForce backdoor using Microsoft Teams TURN relays and MQTT as a fallback command channel

DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

Do Son October 5, 2026

A new DragonForce backdoor hides in Microsoft Teams TURN relays and falls back to MQTT. See how it works and how defenders can spot it.

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions A graphic showing BGP routing hijacking redirecting a server update to a malicious source

A graphic showing BGP routing hijacking redirecting a server update to a malicious source

Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions

Do Son October 1, 2026

Microsoft details NeedyMantis malware, a modular backdoor that uses DLL sideloading to keep long-term access in telecom, academic, and government networks.

PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

Rust supply chain attack on arrayref crate with proc-macro1 typosquat and DPRK infrastructure overlap

PAPERMILL Cybercrime Cluster Delivers VenomRAT via Tax Lures

Do Son September 18, 2026

Security researchers uncovered the new PAPERMILL cybercrime cluster. Learn how the PAPERMILL cybercrime cluster uses tax lures to deploy VenomRAT.

SilkParasite APT Hits Central Asian Governments With 7 RATs SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT Hits Central Asian Governments With 7 RATs

Do Son August 27, 2026

SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Grandoreiro Banking Trojan Returns With a DLL Sideloading Campaign

Do Son August 26, 2026

Grandoreiro banking trojan resurfaces in a DLL sideloading campaign that abuses Duplicate Files Finder to hit Mexico and Latin America.

C2Looper: Rust Backdoor Uses GitHub for C2 Control C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper: Rust Backdoor Uses GitHub for C2 Control

Do Son August 24, 2026

Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT

Do Son August 18, 2026

Trellix details a DCRat campaign using SVG HTML smuggling and process hollowing to deploy DarkCrystal RAT via a Colombian judicial lure.

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

QuickFox Supply Chain Attack Delivers FDMTP Implant to Windows Users

Do Son August 7, 2026

QuickFox supply chain attack trojanizes a VPN app to deploy the FDMTP implant on Windows users. FortiGuard Labs ties it to Twill Typhoon.

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

OctLurk and SilkLurk backdoors targeting Central Asian government espionage campaign

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

Do Son August 5, 2026

Kaspersky GReAT uncovered OctLurk and SilkLurk, two new memory-resident backdoors targeting Central Asian governments since January 2025.

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT infection chain using BYOVD vulnerable drivers and DLL sideloading

SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools

Do Son July 31, 2026

Cato CTRL details a new SilverFox ValleyRAT campaign in Japan using three BYOVD drivers and DLL sideloading to kill security tools.

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

JadeProx Used TriBack Loader Against a Vietnamese Hospital, Malaysia’s Foreign Ministry, and Hong Kong Schools

Do Son July 28, 2026

Group-IB found an exposed server that revealed JadeProx, a China-nexus cluster running TriBack Loader against targets in Vietnam, Malaysia and Hong Kong.

TELESHIM Malware Targets Middle East Governments Through Telegram SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

SonicWall Reconnaissance Akira Ransomware residential proxy malware TraderTraitor BreachForums Honeypot, French Interior Ministry Leak

TELESHIM Malware Targets Middle East Governments Through Telegram

Do Son July 27, 2026

TELESHIM malware hits Middle East governments and abuses Telegram C2 to hide traffic. Zscaler ThreatLabz found the new backdoor and its tooling.

CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges

Foxit PDF Reader vulnerability CVE-2026-57239 exploited for SYSTEM privileges via local privilege escalation

CVE-2026-57239: Public PoC Exploits Foxit PDF Reader Vulnerability for SYSTEM Privileges

Do Son July 23, 2026

A public proof-of-concept for CVE-2026-57239 turns a Foxit PDF Reader vulnerability into full SYSTEM privileges via local privilege escalation.

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet campaign malware delivered through the ViPNet update system on a Russian workstation

HelloNet Campaign Abuses ViPNet Update System to Hit Russian Firms

Do Son July 23, 2026

The HelloNet campaign spreads malware through the ViPNet update system, hitting Russian government and energy firms. Kaspersky suspects a China link.

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT malware email campaign delivering DLL sideloading payload to Japanese and Chinese users

ValleyRAT Malware Hits Japanese and Chinese Users Through Email Attacks

Do Son July 6, 2026

LevelBlue tracks a ValleyRAT malware email campaign using DLL sideloading and fileless execution to hit Japanese and Chinese users.

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

Mustang Panda targets India's government and hydropower sectors, abusing Zoho WorkDrive for C2. Acronis found new ZOHOMURK and MINIRECON implants.

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

Kaspersky details SharkLoader malware, which deploys Cobalt Strike Beacon in the global StrikeShark campaign via DLL sideloading and exploited apps.

Khmer Shadow Espionage Campaign Targets Cambodian Government Trojanized streaming site causing Packagist themes iOS spyware infections

Khmer Shadow Espionage Campaign Targets Cambodian Government

Do Son June 18, 2026

Acronis reveals Khmer Shadow, a new espionage campaign using NIGHTFORGE loader and DLL sideloading to target Cambodian government entities with Havoc Demon.

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

Havoc Stager Campaign Exploits Fake Invoices to Compromise Networks

Do Son June 10, 2026

Discover how the Havoc stager campaign exploits fake invoices. Read the LevelBlue SpiderLabs report detailing this stealthy threat.