'In the cases we analyzed, there were different files used to sideload malicious DLLs. The researchers noted that the victim would not have been notified of the ransomware infection until 10 days after the initial intrusion. The Trend Micro researchers found that the malicious DLLs were checking for the presence of debuggers and Microsoft's default security tools before proceeding with additional malware downloads and installations and uploading of data to several Dropbox locations.įrom there, the attackers looked to keep their access to the infected machines by covertly installing a proxy tool known as node.exe in order to give remote shell access even when the compromised PC has supposedly been purged of malware. From that PowerShell connection, the actual malware is obtained in the form of malicious DLLs and executables.ĭLL sideloading attacks can be particularly difficult to spot because they rely on malicious libraries that run in memory and can often go unchecked by security tools. According to Trend Micro, the hackers first abused the Log4Shell vulnerability to obtain command line access in VMware Horizon over Microsoft's PowerShell tool.

Vmware horizon log4j