Threats

PDFSider Backdoor Deployed Against Fortune 100 Company Using DLL Side-Loading

Zero Day Wire

— 1 min read
PDFSider Backdoor Deployed Against Fortune 100 Company Using DLL Side-Loading

A sophisticated Windows backdoor dubbed PDFSider has been identified in targeted attacks against enterprise environments, including a Fortune 100 financial services company.

The malware demonstrates APT-grade tradecraft while being deployed in ransomware operations, blending advanced evasion techniques with financially motivated attacks.

DLL Side-Loading via PDF24 Creator

PDFSider is delivered through spearphishing emails containing ZIP archives with a legitimate PDF24 Creator executable bundled with a malicious DLL. The malware exploits DLL side-loading by masquerading as cryptbase.dll, a legitimate Windows system file.

When the trusted PDF24 executable runs, it loads the malicious DLL instead of the legitimate one, allowing the malware to execute within a signed, trusted process—effectively bypassing antivirus and EDR solutions.

Advanced Capabilities

The backdoor incorporates multiple sophisticated features:

  • AES-256-GCM encrypted command-and-control communications
  • DNS-based C2 channels to blend with normal traffic
  • In-memory execution to avoid disk-based detection
  • Anti-VM and sandbox evasion techniques
  • System information exfiltration
  • Persistence mechanisms for long-term access

Social Engineering Component

In the reported Fortune 100 incident, attackers combined PDFSider delivery with social engineering tactics. Victims received fake tech support calls requesting access via Microsoft QuickAssist, providing attackers with an initial foothold before deploying the backdoor.

Mitigations

Organizations should consider:

  • Implementing application whitelisting and restricting DLL loading paths
  • Monitoring or disabling remote access tools like QuickAssist in enterprise environments
  • Training staff to recognize fake tech support social engineering
  • Enforcing strict email attachment scanning policies
  • Restricting execution of unsigned or unknown DLLs

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire