Uncovering Executables that Trigger DLL Sideloading Attacks with Endpoint Context

Threat actors are constantly refining their techniques to evade detection and deliver malicious payloads. DLL sideloading is a technique that has seen a resurgence in popularity among cybercriminal and espionage groups. This covert method allows attackers to execute malicious code under the guise of a legitimate and trusted application, making it a formidable challenge for security professionals to detect and mitigate.

This blog post will delve into the mechanics of DLL sideloading, explore how threat actor groups like Silver Fox and REvil leverage this technique and how Zscaler Endpoint Context helps SecOps teams uncover files masquerading as valid executables that trigger DLL files to execute malicious code. 

What is DLL Sideloading?

A Dynamic-Link Library (DLL) is a file that contains code and data that can be used by multiple programs at the same time. DLL sideloading is an attack vector that exploits the way Windows applications search for and load these required DLLs.

When an application is launched, it often needs to load various DLLs to function correctly. If the application doesn't specify the full path to a required DLL, Windows will search for it in a predetermined sequence of directories. Attackers can take advantage of this by placing a malicious DLL with the same name as a legitimate one in a location that Windows searches *before* the directory containing the genuine DLL. When the legitimate application starts, it inadvertently loads and executes the malicious DLL, giving the attacker a foothold in the system.

How Threat Actors Use DLL Sideloading

DLL sideloading is a popular technique for several reasons:

• Evasion: Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions.
• Persistence: If the compromised application is one that runs at startup, the malicious DLL will also be loaded each time the system boots, ensuring the attacker's code persists on the infected machine.
• Privilege Escalation: If the legitimate application runs with elevated privileges, the malicious DLL will inherit those same permissions, allowing the attacker to perform more sensitive actions on the system.

Example 1: Silver Fox's Attack on Accounting and Tax Preparation Firms

Silver Fox, a China-based threat actor group (also known as Void Arachne), has been observed using DLL sideloading in targeted attacks against accounting and tax preparation firms. Their campaigns often involve socially engineered phishing emails with themes directly relevant to accounting professionals, such as tax audits, invoices, and financial reports.

Here’s a step-by-step breakdown of a typical Silver Fox attack:

1. Initial Access: The attack begins with a spear-phishing email sent to an employee at an accounting firm. The email might be disguised as an official communication from a tax authority, complete with a malicious attachment, such as a PDF or a ZIP file. In one documented case, the filename was "The blacklist of tax-related accounting personnel in March is as follows.exe" to entice the victim.
2. Lure and Execution: The user is tricked into opening the attachment. The attachment is a dropper that contains a legitimate, signed executable from a known software vendor (e.g., Tencent, Zeon Corporation, or Thunder Download Manager) and a malicious DLL.

DLL Sideloading: The legitimate executable is launched. It needs to load a specific DLL to run, but instead of loading the legitimate one from the system directory, it loads the malicious DLL that the attacker placed in the same directory. For instance, Silver Fox has been known to use ‘ConvertToPDF.exe’ and ‘PDFDirect.exe’ from Zeon Corporation to sideload a malicious DLL named ‘PDFCORE8.dll.’

1. Payload Delivery: The malicious DLL, now running under the trusted process of the legitimate application, decrypts and deploys the final payload. In Silver Fox's case, this is often ValleyRAT, a remote access trojan (RAT).

2. Post-Exploitation: With ValleyRAT installed, the attackers have full control over the compromised system. They can steal sensitive data (client information, financial records), log keystrokes, and deploy further malware.

    

Example 2: REvil Ransomware's Use of DLL Sideloading

The notorious ransomware-as-a-service (RaaS) group, REvil (also known as Sodinokibi), has also employed DLL sideloading to execute its ransomware.

Here's how they did it:

1. Initial Compromise: REvil gained initial access to a target's network through various means, such as exploiting vulnerabilities or using stolen credentials.
2. Dropping the Files: Once inside, the attackers would drop two files into a directory on the compromised system: a legitimate, signed Microsoft Defender executable (`MsMpEng.exe`) and a malicious DLL named `mpsvc.dll`.
3. Sideloading the Ransomware: The attackers would then execute `MsMpEng.exe`. This legitimate Microsoft process would then load the malicious `mpsvc.dll`, which contained the REvil ransomware payload.
4. Encryption and Ransom: The ransomware, now running under a trusted Microsoft process, would begin encrypting files on the system and network shares. A ransom note would then be displayed, demanding payment for the decryption key.

Zscaler's cloud-native platform provides a multi-layered defense to proactively stop DLL sideloading attacks before they can compromise an endpoint. Zscaler's approach is multipronged and anchored by our platform’s ability to inspect massive quantities of transactions at global scale to prevent malicious DLLs from reaching users’ devices in the first place.

Threat actors leverage DLL sideloading because it abuses the trust placed in legitimately signed executables. Both REvil (Sodinokibi) and Silver Fox (Void Arachne) exploit this: REvil drops a malicious mpsvc.dll alongside an old, validly-signed copy of Microsoft Defender (MsMpEng.exe) to deliver its ransomware encryptor, while Silver Fox uses signed applications like NtHandleCallback.exe or QnWallpaper.exe to sideload encrypted shellcode DLLs (e.g., log.dll, libcef.dll) that deploy ValleyRAT or Gh0st RAT backdoors.

Zscaler Endpoint Context disrupts these attack chains at multiple stages:

1. Pre-Execution DLL Interception

The Endpoint Sandbox extends Zscaler's cloud-based behavioral analysis to the endpoint itself. Before an unknown or suspicious DLL executes, whether delivered via phishing download, SEO poisoning, or trojanized installer, the sandbox can hold the file, analyze it, and block execution if it is deemed malicious. This stops both REvil's mpsvc.dll drop and Silver Fox's encrypted shellcode DLLs before they ever load.

2. Process-Network Correlation to Catch Sideloading Anomalies

Endpoint Context enriches every network transaction with the initiating process name, file path, hash (MD5/SHA-256), and code-signing certificate status. This surfaces the hallmark red flag of sideloading: a legitimately signed binary making suspicious network calls while running from an atypical location (e.g., %TEMP%, %PUBLIC%, or AppData). A policy can then automatically block or alert on that traffic. For example, flagging MsMpEng.exe calling out to a command-and-control server from a user's Downloads folder.

3. Certificate and Hash Validation

By continuously verifying code-signing status, Endpoint Context detects the "white-plus-black" pattern Silver Fox relies on where a signed host binary loads an unsigned or tampered DLL. Any DLL with an invalid, expired, or missing certificate loaded by an otherwise trusted process is flagged, breaking the chain of assumed trust.

4. Application Risk Scoring and Zero Trust Policy Enforcement

Endpoint Context assigns dynamic risk scores to running processes based on CVEs, behavioral signals, and vulnerability data. Policies can automatically restrict internet or private-app access for any process with a high-risk classification, preventing post-sideload lateral movement or data exfiltration even if a malicious DLL does load.

5. Enriched SOC Telemetry

All process, path, hash, and certificate data is streamed via the Nanolog Streaming Service (NSS) to SIEM tools, giving security teams the correlation context needed to quickly identify sideloading campaigns — without manually pivoting between EDR consoles and network logs.

Conclusion and Mitigation Strategies

DLL sideloading poses a significant threat to organizations of all sizes. However, there are steps that can be taken to mitigate the risk:

• Zsacler Endpoint Context: Monitor for suspicious process behaviors, such as an application loading a DLL from an unusual path, which can help detect sideloading attempts.
• Application Whitelisting: By allowing only approved applications to run, organizations can prevent unauthorized executables from being used to sideload malicious DLLs.
• Secure Coding Practices: Developers can help prevent these attacks by specifying the full path to required DLLs in their applications and digitally signing all DLLs.
• User Education: Training users to be cautious of unsolicited emails and attachments can help prevent the initial compromise that often leads to a DLL sideloading attack.
• Principle of Least Privilege: Restricting user permissions to prevent files from being written to critical application directories can stop attackers from placing malicious DLLs in the first place.

By understanding the mechanics of DLL sideloading and implementing a layered security approach, organizations can better defend themselves against this insidious attack vector. Learn more by requesting a demo.