Free, Unbiased, and Open threat intelligence
Free, Unbiased, and Open threat intelligence
threat Profile
Lab52 identified sophisticated modular loaders used by the Lazarus group in DreamJob campaigns during August 2025. The campaign, dubbed 'DreamLoaders', involves multiple deployment methods using legitimate system executables for DLL sideloading. Attackers target administrators of organizations to execute malware for credential extraction and further system compromise. Three deployment variants were observed: a trojanized TightVNC client (tnsviewer.exe), DLL loaders (webservices.dll and radcui.dll) executed via legitimate Windows binaries, and TSVIPSrv.dll deployed via malicious service. The loaders decrypt and load modular payloads stored in .mui files, with HideFirstLetter.dll attempting authentication to Microsoft tenants and accessing SharePoint servers via Microsoft Graph API. The modular architecture allows deployment of different payloads based on operational needs, with identical payloads found across multiple compromised systems indicating coordinated targeting.
Threat Actors
Published
7 months ago
Views
15