TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers at Zscaler ThreatLabz have uncovered a malicious campaign targeting government entities in the Middle East, attributed to an East Asian…
Tag: DLL Sideloading
TELESHIM: Telegram-Based C2 Backdoor
TELESHIM is a 32-bit Windows backdoor that abuses the Telegram API for command-and-control communication. It uses DLL side-loading via RegSchdTask.exe and AsTaskSched.dll,…
MIXEDKEY: Reflective Loader Malware
MIXEDKEY is a reflective loader used in the attack chain to decrypt and execute the final BINDCLOAK payload. It is delivered via…
China-Nexus JadeProx Deploys New TriBack Loader in Attacks on Government and Healthcare
Group-IB has uncovered a China-nexus cyber operation tracked as JadeProx, which has been targeting government, healthcare, and education organizations across Asia and…
TriBack Loader: New Windows Loader Used by JadeProx
TriBack Loader is a previously undocumented Windows loader used by the JadeProx operation. It employs DLL sideloading with four infection chains, using…
Modular .NET Remote Access Trojan (RAT)
A modular .NET RAT delivered via DLL sideloading through a signed Ubisoft binary, part of the DlrtyGames campaign.
Ubisoft: Video Game Publisher
Its signed binary was used for DLL sideloading in the DlrtyGames campaign.
Mustang Panda Abuses Zoho WorkDrive as Command Channel in Indian Government Attacks
The China-aligned espionage group Mustang Panda is running two campaigns against Indian government and hydropower targets, deploying new malware and turning a…
SHARDLOADER: DLL Sideloading Malware Loader
SHARDLOADER is a malware loader used by Mustang Panda that sideloads a malicious DLL through legitimately signed binaries like Solid PDF Creator…