Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Intruders in the Library: Exploring DLL Hijacking

Summary: Unit 42 describes DLL hijacking as one of the oldest techniques still in use, in which an operating system is tricked into loading a malicious binary instead of a legitimate DLL, and notes that its prevalence has been rising because exploiting legitimate executables is not considered particularly difficult. The article covers three common techniques - DLL side-loading, DLL search order hijacking and phantom DLL loading - with examples including Stately Taurus using side-loading to install the ToneShell backdoor in September 2023, PlugX spreading via a compromised USB device, an AsyncRAT phishing campaign targeting victims in Colombia and Argentina, and CatB ransomware abusing the MSDTC service for phantom DLL loading.

What's compelling: Detecting an attacker loading camouflaged DLLs inside legitimate executables remains a complex undertaking, so the malicious DLL arrives inside a trusted program rather than as a suspicious file. The CatB example shows the payoff: a dropper writes oci.dll to System32 and msdtc.exe reloads it as the ransomware payload.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026