Finding Minhook in a sideloading attack – and Sweden too
A threat actor campaign targeting multiple locations was observed in late 2023 and early 2024. Initially focused on the Far East, it later shifted to Sweden. The attacks used DLL sideloading techniques, employing the Minhook library to detour Windows API calls. The clean loader was obtained from infected systems rather than being part of the sideloading package. Components were signed with a compromised digital signature. The final payload was Cobalt Strike. Three sideloading scenarios were identified: MiracastView, PrintDialog, and SystemSettings. The Swedish connection revealed an installer with components from previous scenarios and the use of an expired digital signature from a Korean game developer.
Pulse ID: 68138a216574269c2912f720
Pulse Link: https://otx.alienvault.com/pulse/68138a216574269c2912f720
Pulse Author: AlienVault
Created: 2025-05-01 14:50:09
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CobaltStrike #CyberSecurity #InfoSec #Korea #OTX #OpenThreatExchange #RAT #SideLoading #Sweden #Windows #bot #iOS #AlienVault