PDFSIDER Discovered: New APT Malware Uses DLL Side-Loading to Evade Detection

PDFSIDER, a newly identified APT malware variant, was uncovered by Resecurity and uses DLL side-loading to evade detection. The attack starts with a counterfeit library, with PDFSIDER distributing itself via a malicious ZIP archive often masquerading as legitimate software components, and it uses a fake cryptbase.dll to hijack the execution flow of a trusted application.

It also embeds a Botan cryptographic library configured for AES-256-GCM, enabling encrypted command-and-control communications and the operator’s ability to run an interactive, hidden command shell. According to Resecurity, this approach allows the threat actors to blend with legitimate system activity and bypass standard antivirus and EDR safeguards.

Resecurity notes that such DLL sideloading was used to bypass controls and deliver a broad range of commodity trojans, and that PDFSIDER represents a dangerous refinement of APT capabilities with stealthy execution and encrypted communications. The report also draws parallels with tactics seen in campaigns attributed to the China-linked Mustang Panda, suggesting a broader trend toward living-off-the-land techniques. 20 January 2026.