Procedure examples

ShinyHunters has established a connection between the staging host and the C2 using SSH.

SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.

GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.

A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. APT41 has also used legitimate executables to perform DLL side-loading of their malware.

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.

Storm-1811 has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of `b` at runtime to load a Cobalt Strike beacon payload.

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.

Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory. Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.

Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons. Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs.

Chimera has used side loading to place malicious DLLs in memory.

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.

BackdoorDiplomacy has executed DLL search order hijacking.

Whitefly has used search order hijacking to run the loader Vcrodat.

LuminousMoth has used legitimate executables such as `winword.exe` and `igfxem.exe` to side-load their malware.

RTM has used search order hijacking to force TeamViewer to load a malicious DLL.

APT-C-36 has used side-loading to execute the HijackLoader payload.

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.

Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload. Lazarus Group utilized DLL side-loading to execute malicious payloads through abuse of the legitimate processes `wsmprovhost.exe` and `dfrgui.exe`.

Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.

Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.

WIRTE has used RAR archives containing a legitimate executable and a lure document to execute malicious DLLs via sideloading.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.

FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.

Mustang Panda has leveraged legitimate software installer executables such as Setup Factory “IRSetup.exe” to drop and execute their payload.

APT41 has configured payloads to load via LD_PRELOAD.

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.

Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

Scattered Spider has created Amazon EC2 instances within the victim's environment.

LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.

Storm-0501 has conducted mass deletion of cloud data stores and resources from Azure subscriptions.

LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.

Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .

Storm-0501 has enumerated compromised cloud environments to identify critical assets, data stores, and back resources.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.

Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.