Google Desktop Search: Discontinued Application Abused in Malware Attack
Google Desktop Search, a discontinued application, was abused by Umbrij malware for DLL side-loading. The tool was originally used for indexing files…
Tag: DLL side-loading
ToddyCat APT Deploys Umbrij Malware to Hijack Gmail via OAuth Token Theft
A new malware strain named Umbrij, attributed to the advanced persistent threat (APT) group ToddyCat, is abusing OAuth 2.0 tokens to gain…
ToddyCat: APT Group Exploiting ESET Search-Order Flaw
ToddyCat is an advanced persistent threat group that exploited a search-order flaw in ESET's command-line scanner to load malicious DLLs. This was…
Umbrij Malware: OAuth Token Theft via Headless Browser Exploitation
Umbrij is a .NET-based malware attributed to the ToddyCat APT group, designed to steal OAuth tokens from Gmail accounts. It exploits Chromium-based…
Microsoft Visual Studio: Development Tool Component Abused in Attack
Microsoft Visual Studio's VSTestVideoRecorder.exe was abused by Umbrij malware for DLL side-loading. Visual Studio is an integrated development environment from Microsoft.
Tencent Executable Abused for DLL Side-Loading
Tencent is a technology company whose signed executable is abused in the Spark RAT campaign for DLL side-loading to deliver malicious payloads.
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Unknown threat actors are leveraging the ScreenConnect remote access tool to deploy and execute AsyncRAT as part of a massive, multi-domain, multi-language…
StrikeShark Campaign Uses Novel SharkLoader Malware to Deploy Cobalt Strike Beacon
A newly identified cyber attack campaign, tracked as StrikeShark by Kaspersky, is deploying a previously undocumented malware family called SharkLoader to deliver…
SharkLoader Malware: A New Loader for Cobalt Strike in StrikeShark Campaigns
SharkLoader is a previously undocumented malware family used as a loader to deploy Cobalt Strike Beacon. It employs Perfect DLL Hijacking to…
CVE-2021-27076: Microsoft SharePoint Vulnerability Used for DLL Side-Loading in StrikeShark
CVE-2021-27076 is a remote code execution vulnerability in Microsoft SharePoint. In StrikeShark, it was used to trigger a DLL side-loading chain to…