// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1055
Technique T1055

Process Injection

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Process Injection (T1055) — a Defense Evasion technique, observed in public incident reporting.
MITRE ATT&CKT1055
TacticDefense Evasion
Incidents on file25

Detection & mitigation

Monitor for suspicious process injections (e.g., unusual cross-process memory writes) and anomalous network connections to Solana RPC endpoints. Use EDR with behavioral detection and blockchain DNS monitoring to identify C2 resolution patterns.

Observed in the wild

2026-09-17
process injection
MovieReaper Torrent Trojan and Solana C2 Analysis
2026-09-14
process injection
AsyncRAT Campaign Uses AutoIt and PowerShell to Hide in Legitimate Windows Process
2026-08-05
process injection
Darktrace analyzes ZionSiphon malware targeting Israeli water treatment OT systems
2026-08-02
process injection
VioletRAT Malware Framework Emerges with Advanced Stealth and Botnet Capabilities
2026-07-26
process injection
msaRAT Hides C2 Inside Legitimate Browser Processes to Evade EDR
2026-07-02
process injection
ValleyRAT Campaign Uses RC4 Encryption, Donut Shellcode, and rundll32 Injection to Evade Detection
2026-06-25
process injection
LokiBot Campaign Uses JScript, .NET Injector, and Process Injection to Steal Credentials
2026-06-25
process injection
StrikeShark Campaign Deploys Cobalt Strike via SharkLoader Malware
2026-06-25
process injection
Mistic Backdoor Deployed by KongTuke Access Broker Targets Enterprise Networks
2026-06-01
process injection
Fake Purchase Order Emails Deliver Fileless PureLogs Malware via Process Hollowing
2026-05-22
process injection
Lazarus Group Deploys RemotePE RAT in Memory-Only Attacks
2025-11-05
process injection
TNFBypass Tool Released to Bypass TNFlash.exe Verification in TN ROM 3.x
2025-08-14
process injection
Proof-of-Concept Tool Bypasses Chrome App-Bound Encryption to Extract Browser Secrets
2025-07-24
process injection
Updated DLL Injection Tool Bypasses Respondus LockDown Browser Protections
2025-07-24
process injection
Researchers demonstrate EDR bypass using process hollowing, DLL unhooking, and syscall obfuscation
2025-06-25
process injection
Research Demonstrates Multi-Layered Techniques to Bypass Windows Defender for Metasploit Payloads
2025-05-22
process injection
Novel Process Injection Technique Evades EDR by Skipping Memory Allocation and Write Steps
2025-03-05
process injection
Two EDR Evasion Techniques Tested Against CrowdStrike: Python Shellcode Execution and Go Reverse SSH Tunnel
2024-10-29
process injection
PoC Exploit for CVE-2024-0311 Skyhigh Client Proxy Bypass
2024-10-27
process injection
Windows API Memory Injection Technique Bypasses EDR and AV
2024-10-15
process injection
Outflank Introduces Early Cascade Injection Process Injection Technique
2024-06-18
process injection
Proof-of-Concept Tool Bypasses Pearson LockDown Browser VM Detection
2024-04-26
process injection
Research Demonstrates RASP Bypass in Java via Process Injection
2023-12-06
process injection
Pool Party Process Injection Techniques Bypass Major EDR Solutions
2023-11-18
process injection
Process Stomping: Injecting Shellcode into RWX Sections of Executables

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →