Executive Summary
In 2025, Kaspersky advanced their detection capabilities against DLL hijacking attacks by developing and deploying machine learning (ML) models. DLL hijacking, used by both organized malware developers (such as those behind Lumma stealer) and advanced persistent threat (APT) groups, involves loading malicious DLLs in place of genuine libraries. Attackers exploited trusted processes to evade detection and complicate incident response. Kaspersky’s internal telemetry revealed a sharp uptick in these attacks across diverse regions and sectors, prompting an iterative ML-driven approach. By refining training datasets, extracting relevant behavioral features, and evolving their models through analyst feedback, Kaspersky achieved higher true positive rates and reduced false positives, integrating the solution into SIEM and MDR offerings to surface live threats.
Why This Matters Now
Attack Path Analysis
Attackers leveraged DLL hijacking to inject malicious code into legitimate processes, gaining a foothold within cloud-hosted workloads, often via spear-phishing or supply chain delivery. Once inside, they exploited software vulnerabilities or misconfigurations to escalate privileges on the compromised system. With elevated access, the adversaries moved laterally within the cloud or hybrid environment, targeting adjacent workloads and services. C2 communication was established by leveraging encrypted or obfuscated outbound channels to evade basic monitoring controls. Sensitive data was then exfiltrated using legitimate cloud services or covert channels. The final stage could involve deploying ransomware, stealing credentials, or disrupting operations through destruction or persistent access.
Kill Chain Progression
Initial Compromise
Description
Attackers delivered a malicious DLL to a cloud workload, typically by exploiting software supply chain weaknesses or spear-phishing, resulting in execution of code via DLL hijacking within a trusted process.
Related CVEs
CVE-2024-11859
CVSS 7.8A DLL search order hijacking vulnerability in certain Windows applications allows attackers with administrator privileges to execute arbitrary code.
Affected Products:
Microsoft Windows – unspecified
Exploit Status:
proof of conceptReferences:
CVE-2025-7676
CVSS 5.4A DLL hijacking vulnerability in Windows 11 for ARM64 allows attackers to execute arbitrary code by placing a malicious DLL in the same directory as a vulnerable executable.
Affected Products:
Microsoft Windows 11 ARM64 – < 24H2
Exploit Status:
no public exploitCVE-2023-28929
CVSS 8.6A DLL hijacking vulnerability in Trend Micro Security for Windows allows attackers to execute malicious code each time the executable file is started.
Affected Products:
Trend Micro Trend Micro Security – 2021 (17.0.1412 and below), 2022/2023 (17.7.1476 and below)
Exploit Status:
no public exploitCVE-2024-33673
CVSS 7.8An improper access control vulnerability in Veritas Backup Exec allows attackers to exploit DLL hijacking by manipulating the Windows DLL search path.
Affected Products:
Veritas Backup Exec – < 22.2 HotFix 917391
Exploit Status:
no public exploitCVE-2023-28260
CVSS 7.8A DLL hijacking vulnerability in Microsoft .NET and Visual Studio allows attackers to execute malicious code on affected systems.
Affected Products:
Microsoft .NET – 6.0.0 to 6.0.16, 7.0.0 to 7.0.5
Microsoft Visual Studio 2022 – 17.0 to 17.5.4
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
DLL Search Order Hijacking
DLL Side-Loading
Process Injection
Match Legitimate Name or Location
Obfuscated Files or Information
Signed Binary Proxy Execution
Shortcut Modification
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS v4.0 – Automated audit logs for security events
Control ID: 10.2.5
NYDFS 23 NYCRR 500 – Cybersecurity Policy & Penetration Testing
Control ID: 500.03, 500.05
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Art. 9(2)(a)-(b)
CISA Zero Trust Maturity Model 2.0 – Continuous Threat Detection and Risk Monitoring
Control ID: Detect - Monitoring & Analytics
NIS2 Directive (EU) – Incident Detection and Response
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Banking systems highly vulnerable to DLL hijacking attacks targeting critical applications, with machine learning detection essential for preventing data breaches and regulatory violations.
Computer Software/Engineering
Software development environments face elevated DLL hijacking risks from malicious library substitutions, requiring enhanced security controls to protect intellectual property and deployment pipelines.
Health Care / Life Sciences
Healthcare applications susceptible to DLL sideloading attacks compromising patient data systems, necessitating advanced threat detection to maintain HIPAA compliance and system integrity.
Government Administration
Government systems targeted by APT groups using DLL hijacking techniques, requiring sophisticated machine learning models to detect advanced persistent threats and protect classified information.
Sources
- How we trained an ML model to detect DLL hijackinghttps://securelist.com/building-ml-model-to-detect-dll-hijacking/117565/Verified
- Kaspersky: DLL hijacking attacks have doubled since 2023https://me-en.kaspersky.com/about/press-releases/kaspersky-dll-hijacking-attacks-have-doubled-since-2023Verified
- SECURITY BULLETIN:: Trend Micro Security DLL Hijackinghttps://helpcenter.trendmicro.com/en-us/article/tmka-19062Verified
- Cimon CmnView DLL Hijacking Vulnerability | CISAhttps://www.cisa.gov/news-events/ics-advisories/icsa-15-069-01Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west traffic inspection, and enforced egress controls would have significantly limited the attack's progression by isolating workloads, detecting anomalous communication, and restricting unauthorized outbound traffic. Visibility and anomaly detection would have enabled faster detection of DLL hijacking behaviors within trusted processes.
Control: Threat Detection & Anomaly Response
Mitigation: Abnormal DLL loading behavior is detected, triggering response actions.
Control: Zero Trust Segmentation
Mitigation: Lateral privilege escalation attempts are blocked by microsegmentation and least privilege policies.
Control: East-West Traffic Security
Mitigation: Unauthorized internal movement is blocked and flagged for investigation.
Control: Egress Security & Policy Enforcement
Mitigation: Malicious C2 traffic is blocked or alert-generated based on egress filtering policies.
Control: Encrypted Traffic (HPE) + Egress Security & Policy Enforcement
Mitigation: Data exfiltration attempts are detected or stopped at the egress boundary.
Malicious changes or attacks are rapidly detected, and automated controls limit the impact.
Impact at a Glance
Affected Business Functions
- IT Operations
- Data Security
- Compliance
Estimated downtime: 3 days
Estimated loss: $500,000
Potential exposure of sensitive customer data and intellectual property due to unauthorized code execution.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy anomaly detection to monitor for DLL hijacking and unusual process behaviors within all cloud workloads.
- • Enforce Zero Trust segmentation between workloads to contain privilege escalation and east-west movement.
- • Apply strict egress controls and FQDN filtering to prevent unauthorized outbound and exfiltration traffic.
- • Leverage central visibility for real-time monitoring and baselining across multi-cloud and hybrid environments.
- • Integrate inline protection and automated response via distributed Cloud Native Security Fabric controls for swift containment of emerging threats.
