[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-GejuXexRCLfoObOj2_85ab3PI14nnkV5gCikszTbE0":3},{"article":4,"iocs":47,"watch_terms":51,"solutions":52,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"4e8e264f-96c2-400a-921f-4d66ad49eccb","Related archive contains legit signed WinWord.exe from Microsoft to load a malicious \"AppvIsvSubs...","related-archive-contains-legit-signed-winword-exe-from-microsoft-to-load-a-malic","Related archive contains legit signed WinWord.exe from Microsoft to load a malicious \"AppvIsvSubsystems64.dll\" file...\n🤷‍♂️ https:\u002F\u002Ft.co\u002Fcy4v9TE3hz","A malware campaign is leveraging legitimate, Microsoft-signed WinWord.exe executables to sideload a malicious AppvIsvSubsystems64.dll file. This DLL hijacking technique abuses the trust placed in Microsoft-signed binaries to evade detection and execute arbitrary code. The attack demonstrates a sophisticated supply-chain-adjacent technique that exploits DLL search order and code signing trust.","Legitimate signed WinWord.exe used to load malicious AppvIsvSubsystems64.dll","https:\u002F\u002Fx.com\u002Fmalwrhunterteam\u002Fstatus\u002F2041798940291428419","https:\u002F\u002Fpbs.twimg.com\u002Fmedia\u002FHFXsuEcXsAA1xza.jpg","2026-04-08T08:42:56+00:00","2026-04-08T09:00:18.24749+00:00",8,[17,20,23],{"name":18,"type":19},"WinWord.exe","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"DLL sideloading","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":30,"value":49,"context":50},"AppvIsvSubsystems64.dll","Malicious DLL sideloaded via legitimate WinWord.exe",[21,18],{"controls":53,"vendors":132},[54,83,103],{"slug":55,"name":56,"problem":57,"products":58},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[88,96],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":97,"vendor_name":21,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":104,"name":105,"problem":106,"products":107},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[108,116,124],{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[133],{"slug":97,"name":21,"logo_path":98,"roles":134},[135],"affected",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":147},"dll-hijacking-attack-abuses-microsoft-signed-executables","DLL Hijacking Attack Abuses Microsoft-Signed Executables","Attackers exploited DLL search order vulnerabilities by placing a malicious AppvIsvSubsystems64.dll file alongside legitimate Microsoft-signed WinWord.exe executables. This technique leverages the inherent trust in code-signed binaries to bypass security controls and execute malicious code. The attack demonstrates how threat actors can abuse legitimate software components and Windows DLL loading mechanisms to evade detection. Organizations must recognize that even trusted, signed executables can be weaponized when proper application controls and monitoring are not in place.",[141,142,143,144,145,146],"CIS Control 2","CIS Control 8","NIST SC-18","NIST SI-7","NIST AC-6","MITRE ATT&CK T1574.001",{}]