Sodinokibi - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/sodinokibi/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 18:37:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgREvil Ransomware DLL Side-Loading via Msmpeng.exehttps://feed.craftedsignal.io/briefs/2026-08-msmpeng-dll-sideloading/Mon, 17 Aug 2026 18:37:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-msmpeng-dll-sideloading/The REvil ransomware group employs DLL side-loading to bypass security controls by placing malicious 'msmpeng.exe' or 'mpsvc.dll' files in non-standard directories to execute payloads.The REvil ransomware threat group leverages a DLL side-loading technique to achieve persistence and facilitate code execution. Attackers drop malicious versions of the Windows Defender binaries 'msmpeng.exe' (the Antimalware Service Executable) or 'mpsvc.dll' (the Antimalware Service Library) into unauthorized file system locations. By placing these files outside of the protected 'C:\Program Files\Windows Defender' or 'WinSxS' directories, the threat actor forces the operating system to load the malicious library instead of the legitimate one when the service is invoked. This tactic is used to evade security monitoring, as the malicious activity appears to originate from a trusted Microsoft binary. Successful exploitation allows for the deployment of ransomware, leading to broad data encryption, system compromise, and significant extortion risks. This behavior has been observed in campaigns targeting enterprise organizations.

Attack Chain

  1. The attacker gains initial access to the target environment via compromised credentials or exploit.
  2. The attacker performs internal reconnaissance to identify writable directories outside of System32 or protected program paths.
  3. The attacker drops a malicious library, 'mpsvc.dll', or a renamed executable, 'msmpeng.exe', into the identified writable directory.
  4. The attacker establishes persistence by modifying registry keys or creating services to point to the malicious binary location.
  5. The OS initiates the side-loading process when the malicious executable is triggered or the service is restarted.
  6. The legitimate binary loads the malicious 'mpsvc.dll' from the attacker-controlled folder due to DLL search order hijacking.
  7. The payload executes in the context of the high-privileged Antimalware Service process.
  8. Final objective: Ransomware deployment, file encryption, and exfiltration of sensitive data.

Impact

Successful execution of this attack leads to the deployment of the REvil ransomware payload. The impact includes the encryption of critical business data, full system compromise, exfiltration of sensitive corporate information, and the threat of double extortion. Historical attacks associated with this technique have resulted in the disruption of critical infrastructure and widespread business outages.

Recommendation

  1. Enable Sysmon Event ID 11 (FileCreate) across the endpoint fleet to identify suspicious file creation events.
  2. Deploy the Sigma rules below to monitor for 'msmpeng.exe' or 'mpsvc.dll' creation events in unauthorized paths.
  3. Use EDR solutions to alert on child processes spawned by instances of 'msmpeng.exe' that deviate from standard behavior.
  4. Restrict write permissions on directories that are commonly used for side-loading, such as temporary folders or user-writable application data paths.
]]>highthreatransomwarepersistencedefense-evasionside-loading