// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1055
Technique T1055

Process Injection

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Process Injection (T1055) — a Defense Evasion technique, observed in public incident reporting.
MITRE ATT&CKT1055
TacticDefense Evasion
Incidents on file25

Detection & mitigation

Monitor for unusual process injections, especially into trusted processes in OT environments. Deploy endpoint detection that inspects process memory and network connections for encrypted C2 patterns. Segment OT networks and enforce strict application whitelisting.

Observed in the wild

2026-08-05
process injection
Darktrace analyzes ZionSiphon malware targeting Israeli water treatment OT systems
2026-08-02
process injection
VioletRAT Malware Framework Emerges with Advanced Stealth and Botnet Capabilities
2026-07-26
process injection
msaRAT Hides C2 Inside Legitimate Browser Processes to Evade EDR
2026-07-02
process injection
ValleyRAT Campaign Uses RC4 Encryption, Donut Shellcode, and rundll32 Injection to Evade Detection
2026-06-25
process injection
LokiBot Campaign Uses JScript, .NET Injector, and Process Injection to Steal Credentials
2026-06-25
process injection
StrikeShark Campaign Deploys Cobalt Strike via SharkLoader Malware
2026-06-25
process injection
Mistic Backdoor Deployed by KongTuke Access Broker Targets Enterprise Networks
2026-06-01
process injection
Fake Purchase Order Emails Deliver Fileless PureLogs Malware via Process Hollowing
2026-05-22
process injection
Lazarus Group Deploys RemotePE RAT in Memory-Only Attacks
2025-11-05
process injection
TNFBypass Tool Released to Bypass TNFlash.exe Verification in TN ROM 3.x
2025-08-14
process injection
Proof-of-Concept Tool Bypasses Chrome App-Bound Encryption to Extract Browser Secrets
2025-07-24
process injection
Updated DLL Injection Tool Bypasses Respondus LockDown Browser Protections
2025-07-24
process injection
Researchers demonstrate EDR bypass using process hollowing, DLL unhooking, and syscall obfuscation
2025-06-25
process injection
Research Demonstrates Multi-Layered Techniques to Bypass Windows Defender for Metasploit Payloads
2025-05-22
process injection
Novel Process Injection Technique Evades EDR by Skipping Memory Allocation and Write Steps
2025-03-05
process injection
Two EDR Evasion Techniques Tested Against CrowdStrike: Python Shellcode Execution and Go Reverse SSH Tunnel
2024-10-29
process injection
PoC Exploit for CVE-2024-0311 Skyhigh Client Proxy Bypass
2024-10-27
process injection
Windows API Memory Injection Technique Bypasses EDR and AV
2024-10-15
process injection
Outflank Introduces Early Cascade Injection Process Injection Technique
2024-06-18
process injection
Proof-of-Concept Tool Bypasses Pearson LockDown Browser VM Detection
2024-04-26
process injection
Research Demonstrates RASP Bypass in Java via Process Injection
2023-12-06
process injection
Pool Party Process Injection Techniques Bypass Major EDR Solutions
2023-11-18
process injection
Process Stomping: Injecting Shellcode into RWX Sections of Executables
2023-11-16
process injection
Apache ActiveMQ Exploit Enables Stealthy EDR Bypass
2023-11-16
process injection
Evading Windows Defender with MiniDumpWriteDump, Donut, and Process Injection

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →