Hackers Use DLL Side-Loading to Deploy Malicious Python Code

A recent discovery by Xavier Mertens, a senior handler at the Internet Storm Center, has highlighted a sophisticated attack where hackers utilize DLL side-loading to deploy malicious Python code.

This technique involves tricking an application into loading a malicious DLL instead of a legitimate one, allowing attackers to execute malicious code while evading detection by security tools.

The Attack Vector

The attack begins with a ZIP archive named “Hootsuite (1).zip,” which contains a file named Hootsuite.exe disguised as a PDF reader.

This executable is a copy of the old Haihaisoft PDF reader, known to have a DLL side-loading vulnerability. When executed from a normal directory, it functions as expected.

However, when run from the directory extracted from the ZIP archive, it loads a malicious msimg32.dll instead of the legitimate Microsoft version.

This malicious DLL is significantly larger than the official one, likely ...