Skip to content
Threat Feed
Subscribe

Actor

GOLD SOUTHFIELD

1 brief RSS
Also known as: REvil Sodinokibi
high threat

REvil Ransomware DLL Side-Loading via Msmpeng.exe

The REvil ransomware group employs DLL side-loading to bypass security controls by placing malicious 'msmpeng.exe' or 'mpsvc.dll' files in non-standard directories to execute payloads.

Windows Defender REvil +2 ransomware persistence defense-evasion side-loading
1r 2t