Red Cell cybersecurity researchers have identified three malware campaigns that employ phishing emails, hidden scripts, and legitimate Windows applications to infiltrate computers and gain remote access. The investigation, led by researcher Euler Neto, examines the Overlord Remote Access Trojan, Lampion malware, and a new malicious newdev.dll campaign targeting users in Brazil and Portugal. Attackers used fake legal notices, financial documents, and invoice download pages to deceive victims into executing malicious files.
These campaigns demonstrate how cybercriminals can exploit trusted software, cloud storage, and Windows components to deliver malware while evading detection. Once executed, they downloaded additional files from Dropbox or Google Cloud Storage using Windows utilities such as PowerShell and curl. Researchers uncovered that specific payloads employed DLL side-loading, a method where attackers use legitimate programs to load malicious DLL files.
Researchers discovered features such as remote keylogging, mouse control, command execution, file transfers, screen sharing, and hidden command shells.
Organizations should monitor unusual PowerShell activity, unexpected scheduled tasks, unauthorized Defender exclusions, suspicious DLL loading, and unfamiliar network connections. Security teams must enhance phishing defenses and endpoint surveillance to detect malicious behavior before attackers gain persistent access. Partner with 16,000+ SOC teams using ANY.RUN to streamline threat investigations and minimize manual workload.
