DLL side-loading Archives

Tech Optimizer

January 22, 2026

Hackers Weaponized 2,500+ Security Tools to Terminate Endpoint Protection Before Deploying Ransomware

A large-scale campaign is exploiting the truesight.sys Windows security driver from Adlice Software’s RogueKiller antivirus to disable endpoint detection and response (EDR) and antivirus solutions, facilitating the deployment of ransomware and remote access malware. This attack utilizes over 2,500 validly signed variants of the driver, allowing attackers to manipulate legacy driver signing rules to load pre-2015 signed drivers on Windows 11 machines. The vulnerable TrueSight driver exposes an IOCTL command that enables attackers to terminate security processes, providing them with kernel-level access to bypass user-mode protections. The infection chain typically starts with phishing emails or compromised sites, leading to the installation of a downloader that retrieves additional malicious components. The malware establishes persistence and deploys an EDR killer module targeting nearly 200 security products. Once defenses are disabled, the final payload, often a remote access trojan or ransomware, executes with minimal visibility, completing the attack in as little as 30 minutes.

Tech Optimizer

January 19, 2026

PDFSIDER Malware Actively Used by Threat Actors to Bypass Antivirus and EDR Defenses

PDFSIDER is a sophisticated backdoor malware that bypasses modern endpoint detection and response systems. It is distributed through targeted spear-phishing campaigns that exploit vulnerabilities in legitimate PDF software. The malware is delivered via spear-phishing emails containing ZIP archives with a trojanized executable disguised as the PDF24 App. When executed, it uses DLL side-loading to load a malicious DLL (cryptbase.dll) alongside the legitimate PDF24.exe, allowing attackers to execute code without detection. PDFSIDER establishes encrypted command-and-control channels using the Botan 3.0.0 cryptographic library with AES-256 in GCM mode and operates mainly in memory to minimize detectable artifacts. It collects system information and executes commands through hidden cmd.exe processes. The malware employs advanced techniques to evade detection in sandbox and virtual machine environments, including checks for available RAM and debugger presence. Indicators of compromise include the malicious file cryptbase.dll and various clean files associated with the legitimate PDF24 application. Organizations are advised to enforce strict controls on executable files, provide user awareness training, and monitor DNS queries and encrypted traffic to detect PDFSIDER communications. The malware's behavior aligns with tactics used in state-sponsored espionage rather than financially motivated cybercrime.