Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C2

Security researchers from Lab52 have disclosed a Lazarus Group campaign that uses DreamLoader, a modular malware family, to deliver multiple payloads and maintain persistence. The operation, described as mimicking recruiters to lure professionals with fake job offers, employs loaders referred to as DreamLoaders to deploy various components depending on the actors’ needs.

The campaign features loader variants such as Tnsviewer.exe, Webservices.dll, radcui.dll and TSVIPSrv.dll, and uses DLL sideloading with legitimate Windows binaries to hide activity. Two deployment methods were observed, including loading loaders through DLL sideloading of legitimate system executables, and the DreamLoaders incorporate Base64-encoded, encrypted payloads that decrypt into HideFirstLetter.dll for credential theft and reconnaissance.

HideFirstLetter.dll authenticates to the Microsoft URL login.microsoftonline[.]com/common/oauth2/v2.0/token to obtain an access token, and then communicates with the Microsoft Graph API to retrieve the URL of the compromised SharePoint server for stealthy C2 communications, according to Lab52.

The report notes a recursive loading architecture where TSVIPSrv.dll decrypts wordpad.dll[.]mui, enabling further payload loading, and highlights the modular design that allows different payloads to be loaded from independent files. Lab52 also links these findings to Lazarus’s prior tools such as HideFirstLetter.dll and radcui.dll, and to the broader Lazarus techniques of using Microsoft infrastructure for covert operations.