Executive Summary
In early 2024, Kaspersky detected several advanced persistent threat (APT) incidents during pilot testing of their machine-learning-based DLL-hijacking detection module within their SIEM platform. Notably, the ToddyCat APT group exploited a SharePoint vulnerability (CVE-2021-27076) to gain initial access, then leveraged DLL sideloading to execute Cobalt Strike implants using masqueraded Windows system libraries. Other real-world incidents uncovered included infostealer malware posing as a policy manager, and a malicious loader activated through a USB drive, all utilizing DLL hijacking for code execution and persistence. Kaspersky’s detection tool enabled rapid identification and response, preventing further compromise and data exfiltration.
This case highlights the growing sophistication of DLL hijacking techniques in APT operations and the increasing use of AI-driven security products to detect lateral movement and stealthy intrusion behaviors. The incidents underscore the need for robust behavioral analytics and real-time anomaly detection as threat actors increasingly target supply chains and trusted binaries to bypass traditional security defenses.
Why This Matters Now
DLL hijacking is an escalating threat technique in modern attacks, enabling advanced threat actors to evade security controls by abusing trusted processes. As organizations adopt richer software environments and hybrid infrastructures, adversaries are taking advantage of DLL search order weaknesses. Rapid, automated detection—like that enabled by machine learning models in SIEM—has become critical to close this detection gap and mitigate the risk of stealthy lateral movement.
Attack Path Analysis
Attackers initially exploited a SharePoint vulnerability to gain execution on a web server, then established persistence via DLL sideloading and scheduled tasks masquerading as legitimate processes. Privilege escalation was achieved by launching processes with SYSTEM-level scheduled tasks, allowing attacker code to run at high privilege. The attackers performed lateral movement and reconnaissance, leveraging their foothold to enumerate users, credentials, and system/network details. Command-and-control was established via DNS queries and connections to external servers using the Cobalt Strike implant. Attempts to exfiltrate sensitive data (such as browser credentials or encrypted backdoor payloads) were made through malicious DLLs. The adversary’s ultimate goal was to enable persistent access, data theft, and potential further disruption or compromise, depending on follow-on objectives.
Kill Chain Progression
Initial Compromise
Description
The attacker exploited CVE-2021-27076 in SharePoint via IIS to execute code, followed by DLL sideloading through placement of malicious DLLs alongside legitimate executables.
Related CVEs
CVE-2021-27076
CVSS 8.6A remote code execution vulnerability in Microsoft SharePoint Server allows an attacker to execute arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.
Affected Products:
Microsoft SharePoint Server – 2013, 2016, 2019
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Hijack Execution Flow: DLL Side-Loading
Process Injection: Dynamic-link Library Injection
Command and Scripting Interpreter
Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder
Input Capture
Account Discovery
Application Layer Protocol: Web Protocols
Access Token Manipulation
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Log and Monitor All Access to System Components
Control ID: 10.5.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Art. 9(2)
CISA Zero Trust Maturity Model 2.0 – Continuous real-time monitoring of endpoint activity
Control ID: Device - Continuous Monitoring
NIS2 Directive – Incident Handling and Security Monitoring
Control ID: Art. 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Advanced persistent threats exploiting SharePoint vulnerabilities and DLL hijacking techniques pose severe risks to financial data integrity and regulatory compliance requirements.
Health Care / Life Sciences
DLL hijacking attacks targeting system processes threaten patient data confidentiality and HIPAA compliance, particularly through encrypted traffic manipulation and lateral movement.
Government Administration
APT groups like ToddyCat using Cobalt Strike implants through DLL sideloading present critical national security risks to government infrastructure and sensitive operations.
Information Technology/IT
Machine learning-based detection of DLL hijacking attacks directly impacts IT security operations, requiring enhanced SIEM capabilities and zero trust network implementations.
Sources
- Detecting DLL hijacking with machine learning: real-world caseshttps://securelist.com/detecting-dll-hijacking-with-machine-learning-in-kaspersky-siem/117567/Verified
- ToddyCat APT’s new tools and techniqueshttps://securelist.com/toddycat-apt-steals-email-data-from-outlook/118044/Verified
- NVD - CVE-2021-27076https://nvd.nist.gov/vuln/detail/CVE-2021-27076Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust segmentation, east-west traffic controls, egress enforcement, and real-time threat detection would have significantly disrupted the adversary's ability to persist, move laterally, and exfiltrate data via the DLL hijacking campaign. CNSF controls limit attack spread, block malicious communication attempts, and rapidly detect abnormal behavior associated with the kill chain.
Control: Inline IPS (Suricata)
Mitigation: Prevention of known exploit attempts and malicious payload delivery.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection of anomalous privilege escalation and persistence creation.
Control: East-West Traffic Security
Mitigation: Containment of attacker actions within microsegmented or restricted zones.
Control: Egress Security & Policy Enforcement
Mitigation: Blocking of unauthorized outbound communications to external/internet destinations.
Control: Egress Security & Policy Enforcement
Mitigation: Detection and prevention of unsanctioned data transfers leaving the cloud environment.
Minimizes blast radius and restricts post-compromise actions.
Impact at a Glance
Affected Business Functions
- IT Services
- Data Management
Estimated downtime: 5 days
Estimated loss: $500,000
Potential exposure of sensitive corporate data due to unauthorized access facilitated by the exploitation of the vulnerability.
Recommended Actions
Key Takeaways & Next Steps
- • Conduct ongoing threat detection and anomaly response to identify early-stage persistence via DLL hijacking or suspicious process injection.
- • Implement robust east-west segmentation to limit movement opportunities for compromised hosts or workloads in cloud and hybrid networks.
- • Enforce granular egress controls and DNS filtering to block malicious outbound connections and exfiltration attempts.
- • Deploy inline IPS and signature-based inspection to catch known exploits targeting public-facing web services or legacy protocols.
- • Continuously increase visibility and orchestrate security enforcement via a coordinated Cloud Network Security Fabric across multi/hybrid cloud environments.
