// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Techniques › T1574
Technique T1574

Hijack Execution Flow

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
Hijack Execution Flow (T1574) — a Defense Evasion technique, observed in public incident reporting.
MITRE ATT&CKT1574
TacticDefense Evasion
Incidents on file24

Detection & mitigation

Monitor for unusual process creation from ZIP-extracted LNK files or executables, especially those loading DLLs from non-standard paths. Detect anomalous Azure Blob Storage access patterns from endpoints not typically using such services. Implement application control to block execution from user-writable directories and restrict PowerShell script execution.

Observed in the wild

2026-06-01
dll sideloading
Operation Dragon Weave: China-Aligned Cyber Espionage Campaign Targets Czech Republic and Taiwan
2026-05-26
dll sideloading
Cryptojacking campaign uses SEO poisoning and AI chatbot delivery to deploy ScreenConnect for GPU mining
2026-05-22
dll sideloading
Iranian APT Screening Serpens Uses AppDomainManager Hijacking and New RAT Variants in Espionage Campaigns
2026-05-14
dll sideloading
Seedworm APT Uses Signed SentinelOne Binary for DLL Sideloading in Global Espionage Campaign
2026-05-13
dll sideloading
Nitrogen Ransomware Breaches Foxconn, Exfiltrates 8TB of Supply Chain Data
2026-05-11
dll sideloading
EtherRat and TukTuk Malware Lead to The Gentleman Ransomware Deployment
2026-04-02
dll sideloading
Qilin ransomware deploys multi-stage EDR killer via malicious msimg32.dll
2026-03-30
dll sideloading
Infostealer Campaign Uses DLL Sideloading with Signed Microsoft Office Binary to Evade Detection
2026-03-08
dll sideloading
Windows Defender Execution Folder Hijack via Symbolic Link
2026-01-30
dll sideloading
Local Privilege Escalation in ESET Inspect Connector via OpenSSL DLL Hijacking
2025-11-01
dll sideloading
EDR-Redir V2 Uses Bind Links to Redirect EDR Parent Folders
2025-10-03
dll sideloading
CVE-2025-27237: Zabbix Agent for Windows Local Privilege Escalation via OpenSSL Config DLL Injection
2025-09-20
dll sideloading
McAfee Agent 5.x prior to 5.7.3 Multiple Vulnerabilities
2025-07-30
dll sideloading
CVE-2025-25011: Elastic Beats Uncontrolled Search Path Element Leading to Local Privilege Escalation
2025-06-10
dll sideloading
Chinese Cyberespionage Groups Target SentinelOne in ShadowPad and PurpleHaze Campaigns
2025-04-07
dll sideloading
ToddyCat APT Exploits ESET Command-Line Scanner Vulnerability to Bypass Windows Security
2025-04-04
dll sideloading
Ivanti Endpoint Manager DLL Hijacking Privilege Escalation Vulnerability
2024-09-12
dll sideloading
CVE-2024-20430: Cisco Meraki Systems Manager Agent for Windows Privilege Escalation
2024-09-10
dll sideloading
CVE-2024-8441: Ivanti Endpoint Manager Agent Uncontrolled Search Path Privilege Escalation
2024-04-23
dll sideloading
eScan Antivirus Update Mechanism Abused via MitM to Distribute GuptiMiner Malware
2024-03-13
dll sideloading
ACR Stealer Exploits CVE-2024-21412 to Bypass Microsoft Defender SmartScreen
2024-02-22
dll sideloading
OpenEDR Vulnerabilities Allow Malicious DLL Injection via Driver
2023-10-31
dll sideloading
Atera Agent Package Availability Privilege Escalation via DLL Hijacking
2023-08-30
dll sideloading
CVE-2023-40596: Splunk Enterprise Privilege Escalation via Insecure OPENSSLDIR Path

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →