Sideloading
Finding Minhook in a sideloading attack – and Sweden too
Late in 2023 and during the first half of 2024, we monitored an attack campaign targeting several of our customers in multiple locations. Though the attack attempts dropped a Cobalt Strike payload, which could have led to any number of further activities, the information we were able to glean from our detections causes us to…
Sliver Implant Targets German Entities With DLL Sideloading And Proxying Techniques – Cyble
Key Takeaways Cyble Research and Intelligence Labs (CRIL) has identified an ongoing cyberattack – targeting organizations in Germany. The attack is initiated through a deceptive LNK file embedded within an archive. When executed by an unsuspecting user, this LNK file triggers cmd.exe to copy and run wksprt.exe, a legitimate executable. This executable sideloads a malicious…