Hackers Leverage VLC and VMware Tools for DLL Side-Loading Attacks
Attackers are using legitimate VLC Media Player and VMware components to load malware onto Windows systems through DLL side-loading, making infections harder to detect.
Cybercriminals are employing a sophisticated technique that abuses trusted software like VLC Media Player and VMware components to deploy malware, significantly complicating detection efforts. This method, known as DLL side-loading, tricks legitimate applications into loading malicious libraries, effectively hiding harmful code within seemingly innocuous software.
The attacks have been observed in multiple campaigns targeting users primarily in Brazil and Portugal. These campaigns utilize phishing emails that impersonate official entities, such as Brazilian notary offices, and present recipients with fake legal notices, financial documents, or invoices. The goal is to lure unsuspecting users into downloading malicious files, often disguised as VBScript files or Windows Installer packages.
Researchers have identified three distinct campaigns employing this tactic, involving the Overlord RAT, the Lampion banking malware, and a separate instance using a malicious driver management library. While these campaigns share delivery mechanisms and the core DLL side-loading technique, the findings do not definitively link them to a single threat actor.
In one observed Overlord RAT campaign, attackers used VBScript files that either obfuscated their code by building text from character codes or concatenated strings to obscure their malicious intent. Some of these scripts led to the download of executables or installer packages that utilized DLL side-loading. These malicious libraries were often placed in temporary folders, such as one named 'Adobe,' alongside legitimate Microsoft .NET Framework utilities or the VLC Media Player executable.
A separate campaign, linked to VMware, began with a phishing page offering a "Secure Download - Invoice" that led users to download an ISO disk image. This image contained an obscured VBScript, a legitimate VMware network installation utility, a malicious DLL, and a module-definition file. The trusted VMware executable then served as the loader for the malicious DLL, which decrypted further payloads.
The payloads observed include advanced remote access trojans (RATs) capable of full system control, screen capture, file manipulation, and the creation of hidden interactive shells. These RATs can also execute commands via PowerShell or CMD and are designed to maintain persistence through scheduled tasks or registry entries. Some loaders also attempt to add exclusions to Microsoft Defender to evade security software.
The Lampion banking malware campaign, while sharing some characteristics like heavily padded scripts and references to the number seven, primarily targeted Portugal. The use of finance-themed phishing messages and complex obfuscation techniques in its scripts highlights the evolving nature of these threats.
Security teams are advised to remain vigilant for unexpected script downloads, the creation of new Microsoft Defender exclusions, unfamiliar scheduled tasks, and trusted applications loading libraries from unusual locations. Verifying the integrity of loaded libraries, not just the main executable, is crucial. Comprehensive security strategies should include robust phishing protection, behavior monitoring, and endpoint visibility to detect and mitigate these multi-faceted attack chains.