ZCyberNews
中文

#dll-sideloading

6 articles

Across aviation, banking, communications, critical infrastructure, and education, six articles on dll-sideloading span 13 April 2026 to 6 October 2026. Five are rated high severity. The activity touches Africa, Asia, China, East asia, and India. CL-STA-1178, HelloNet, and LOTUSLITE each appear among the top threat actors tracked in this tag. The collection covers campaigns affecting organisations in these sectors and regions, with the earliest reporting in April and the most recent in October.

Abstract illustration of a network tunnel routed through a code repository interface, representing GitHub-abused command-and-control traffic.
Malware

Blinder Tunnel: Iran-Linked Malware Abuses GitHub C2

Unit 42 ties Iran-nexus CL-STA-1178 to Blinder Tunnel, which hit Iraqi critical infrastructure in March 2026 using fake Dubai Airports lures and GitHub-hosted C2.

4 min readCL-STA-1178
Diagram of ValleyRAT infection chain via adware installerHIGH
Malware

ValleyRAT Backdoor Disguised as Adware Hits Windows Users

Kaspersky found ValleyRAT delivered via fake adware installer that disables Defender and sideloads libcef.dll. Targets Chinese-speaking users.

6 min readValleyRAT
Diagram of HelloNet attack chain showing ViPNet update system DLL sideloading leading to HelloInjector, HelloProxy, and HelloBackdoor modulesHIGH
Threat Intel

HelloNet Campaign Hijacks ViPNet Update System to Deploy Malicious

Kaspersky details HelloNet APT campaign targeting Russian government, energy, and transport sectors via ViPNet update system DLL sideloading since May 2026.

4 min readHelloNet
Microsoft-Signed Binary Hijacked to Deliver LOTUSLITE Backdoor inHIGH
Threat Intel

Microsoft-Signed Binary Hijacked to Deliver LOTUSLITE Backdoor in

State-linked threat actors used a Microsoft-signed binary for DLL sideloading to deploy the LOTUSLITE backdoor against India's banking sector, evading security controls with a…

3 min readLOTUSLITE
PlugX USB Worm Evolves with DLL Sideloading for Cross-Continent SpreadHIGH
Malware

PlugX USB Worm Evolves with DLL Sideloading for Cross-Continent Spread

A new PlugX USB worm variant uses DLL sideloading to propagate across Asia and Africa, targeting removable drives for initial access and establishing persistence.

4 min read
Fake Claude AI Website Delivers PlugX RAT via DLL SideloadingHIGH
Malware

Fake Claude AI Website Delivers PlugX RAT via DLL Sideloading

A fraudulent website impersonating Anthropic's Claude AI distributes a self-deleting installer that deploys the PlugX remote access trojan via DLL sideloading.

4 min read

Stay Updated

Get the latest cybersecurity news delivered to your inbox.