PDFSIDER Malware – Exploitation of DLL Side-Loading for AV and EDR Evasion

PDFSIDER is a newly identified malware variant described by Security Affairs as exploiting DLL side-loading to bypass AV and EDR protections, with Resecurity noting the activity during an investigation of a Fortune 100 energy company’s network intrusion attempt. According to the article, the threat actors used spear-phishing emails directing victims to a ZIP archive containing a legitimate looking executable labeled “PDF24 App,” which is associated with Miron Geek Software GmbH.

The malware employs a fake cryptbase.dll to evade endpoint detection and deploys a backdoor with encrypted command-and-control capabilities, while also enabling remote command execution and system information gathering. The campaign has been linked to various actors, with references to LOTUSLITE in one Acronis attribution and a broader pattern of DLL sideloading observed by Trellix to distribute multiple malware families such as Agent Tesla, CryptBot, Formbook and others.

The piece notes that PDFSIDER is being used by ransomware actors as a payload delivery method and highlights a trend towards decoy documents, including one that purportedly appeared to be authored by the PLA Intelligence Bureau.