Technique T1574

Hijack Execution Flow

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Hijack Execution Flow (T1574) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1574

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for suspicious DLL loads from unusual locations or unsigned DLLs loaded by legitimate executables. Use application control and endpoint detection to flag DLL sideloading attempts, and educate users about opening unsolicited archives.

Observed in the wild

2026-09-19

dll sideloading
Targeted Backdoor Campaign Uses DLL Sideloading Against Afghan Government Agencies

2026-09-18

dll sideloading
China-Linked UNC3569 Backdoors PCs via Sogou Keyboard App

2026-09-12

dll sideloading
PlugX Malware Delivered via MSI Installer Using DLL Sideloading of Legitimate G DATA AVK Binary

2026-09-02

dll sideloading
TukTuk malware steals credentials and disables security tools

2026-09-01

dll sideloading
Gentlemen Ransomware Group Uses DLL Side-Loading and GentleKiller to Evade EDR

2026-08-26

dll sideloading
Fake Claude Desktop Installer Delivers SectopRAT via DLL Sideloading and Blockchain C2

2026-08-22

dll sideloading
Tenable Nessus Agent Link Following Vulnerability

2026-08-17

dll sideloading
SilverFox APT Uses Fake Claude Apps to Target Asian Companies

2026-08-16

dll sideloading
Microsoft Defender for Endpoint Zero-Day Allows DLL Sideloading via Cloud Hydration

2026-08-14

dll sideloading
Bring Your Own EDR Attack Weaponizes SentinelOne to Bypass Windows Security

2026-08-06

dll sideloading
SilverFox Malware Uses DLL Sideloading and Kernel Drivers to Disable Endpoint Security

2026-06-01

dll sideloading
Operation Dragon Weave: China-Aligned Cyber Espionage Campaign Targets Czech Republic and Taiwan

2026-05-26

dll sideloading
Cryptojacking campaign uses SEO poisoning and AI chatbot delivery to deploy ScreenConnect for GPU mining

2026-05-22

dll sideloading
Iranian APT Screening Serpens Uses AppDomainManager Hijacking and New RAT Variants in Espionage Campaigns

2026-05-14

dll sideloading
Seedworm APT Uses Signed SentinelOne Binary for DLL Sideloading in Global Espionage Campaign

2026-05-13

dll sideloading
Nitrogen Ransomware Breaches Foxconn, Exfiltrates 8TB of Supply Chain Data

2026-05-11

dll sideloading
EtherRat and TukTuk Malware Lead to The Gentleman Ransomware Deployment

2026-04-02

dll sideloading
Qilin ransomware deploys multi-stage EDR killer via malicious msimg32.dll

2026-03-30

dll sideloading
Infostealer Campaign Uses DLL Sideloading with Signed Microsoft Office Binary to Evade Detection

2026-03-08

dll sideloading
Windows Defender Execution Folder Hijack via Symbolic Link

2026-01-30

dll sideloading
Local Privilege Escalation in ESET Inspect Connector via OpenSSL DLL Hijacking

2025-11-01

dll sideloading
EDR-Redir V2 Uses Bind Links to Redirect EDR Parent Folders

2025-10-03

dll sideloading
CVE-2025-27237: Zabbix Agent for Windows Local Privilege Escalation via OpenSSL Config DLL Injection

2025-09-20

dll sideloading
McAfee Agent 5.x prior to 5.7.3 Multiple Vulnerabilities

2025-07-30

dll sideloading
CVE-2025-25011: Elastic Beats Uncontrolled Search Path Element Leading to Local Privilege Escalation

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →