Skip to content
Threat Feed

Actor

Cozy Bear

1 brief RSS
Also known as: APT29 NOBELIUM UNC2452 Midnight Blizzard The Dukes
high threat

Potential Vcruntime140 DLL Sideloading

Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library, often used by threat actors like APT29 (via WinELOADER) to load malicious payloads under the guise of legitimate applications, leading to defense evasion, persistence, and privilege escalation.

Visual C++ Redistributable APT29 +5 dll-sideloading vcruntime140.dll wineloader defense-evasion persistence privilege-escalation
2r 3t