RainyDay, Turian and Naikon Malwares Abuse DLL Search Order to Execute Malicious Loaders

Cisco Talos has uncovered a long-running operation active since 2022 in which the RainyDay, Turian and Naikon malwares abuse DLL search order hijacking to deliver a novel PlugX variant. The campaign targets telecommunications and manufacturing organisations across Central and South Asia, with researchers noting a convergence of malware functionality and shared infrastructure linking Naikon and BackdoorDiplomacy groups.

The attack chain begins with a malicious document or email lure, followed by the execution of a legitimate signed binary that is vulnerable to DLL search order hijacking, after which an encrypted shellcode file is read from the same directory. Loader binaries decrypt using XOR and RC4, then decompress with LZNT1 and inject into processes or host a payload in a new process, with loader names including rdmin[.]src, Mcsitesdvisor[.]afx and winslivation.dat.

According to Cisco Talos, the operation demonstrates a shared cryptographic toolkit and loader techniques across RainyDay, Turian and PlugX, suggesting a connected infrastructure and a common development environment, with activity timeline spanning 2016 through 2024 and notable overlaps in victimology across telecom and government sectors. 24 September 2025.