APT-Grade PDFSider Malware Used by Ransomware Groups

SecurityWeek reports that PDFSider, a newly identified malware family, is being used by multiple ransomware groups to provide cyberespionage and remote code execution capabilities via DLL sideloading. The malware is delivered to victims in a ZIP archive attached to spear-phishing emails and is primarily operating in memory, establishing a backdoor loop and encrypted C&C communication using the Botan library. It is designed to harvest system information and offers an interactive hidden shell for command execution.

According to Resecurity, PDFSider was employed in an attack against a Fortune 100 corporation, using social engineering and QuickAssist to gain remote access, with both APTs and cybercriminals favouring DLL sideloading for code execution and detection evasion. The report notes a multi-stage environment validation routine to detect virtualisation and analysis tools, and highlights AV/EDR evasion alongside the sideloading technique as attractive features for threat actors. Mustang Panda, a China-linked APT, has also been observed using DLL sideloading in recent campaigns, according to Acronis.