Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware Access

Storm-0249, an initial access broker, has shifted from broad phishing to surgical strikes that weaponise trusted security tools, according to ReliaQuest’s Threat Research Team. The group now abuses legitimate EDR processes—specifically components of SentinelOne—to cloak activity and pave the way for ransomware access, using DLL sideloading to swap a legitimate SentinelAgentWorker.exe with a malicious SentinelAgentCore.dll.

When the attacker’s SentinelOne binary launches, it loads the malicious DLL instead of the legitimate one, turning the security tool into a Trojan horse and allowing encrypted C2 channels to operate under the guise of normal telemetry. ReliaQuest notes that this does not indicate a SentinelOne vulnerability; rather, the attackers exploit trusted, signed binaries.

Beyond sideloading, Storm-0249 uses LoL techniques, including curl.exe to fetch scripts that are piped into PowerShell’s memory, creating a fileless chain with minimal forensic trace. The attackers’ ultimate aim is to sell access to ransomware groups such as LockBit and ALPHV, after conducting reconnaissance to extract MachineGuid to bind encryption keys to a defender-unfriendly identifier.

ReliaQuest advises defenders to move beyond allow-lists and adopt behavioural analytics, watching for anomalous sideloading, suspicious traffic from trusted EDR processes, and LoLBin abuse. December 15, 2025.