Ankura CTIX FLASH Update - January 5, 2024

Ransomware/Malware Activity

New Method of DLL Hijacking Circumvents Windows Detection

A new Dynamic Link Library (DLL) search order hijacking technique has come to light that allows threat actors to execute arbitrary code on devices that run Windows 10 and Windows 11 within the Windows folder. DLL search order hijacking works by manipulating the sequence that applications use components such as DLLs and executables that may not have been included in the installation package of the application. By injecting code into a targeted process, the threat actor can successfully execute the code in an environment that is classified as safe and trusted so it is less likely to be captured by security tools. Cybersecurity firm Security Joes states in their report that the malicious code is run using a trusted binary under the folder WinSxS (Windows Side by Side). By targeting processes in the WinSxS folder, researchers managed to create more efficient DLL hijacking due to the