CLAIMLOADER

Executive Summary

CLAIMLOADER threatens Windows environments by hijacking legitimate processes through DLL side‑loading. The payload is stealthily injected, often establishing persistence via scheduled tasks and harvesting credentials before exfiltration. It exploits the trust inherent in trusted binaries to bypass traditional security controls.

CLAIMLOADER is a Windows‑based malware family that operates by co‑existing with legitimate binaries and exploiting DLL side‑loading techniques commonly used by the Mustang Panda threat actor group. The loader typically resides in the same directory as a trusted executable. When the legitimate application launches, it loads any adjacent Dynamic Link Library (DLL) before or after the intended component, allowing CLAIMLOADER to inject malicious code into an otherwise benign process. This method bypasses many traditional endpoint detection controls because the malicious DLL is executed with the privileged token of the host application. Once loaded, the malware often establishes persistence by creating scheduled tasks or registry Run keys, and performs credential harvesting or lateral movement via Process Injection (T1055). It may also exfiltrate data silently while masquerading as a legitimate system process. The variant was first detected in 2021 but has only been documented publicly through IBM publications dated mid‑2025. Given its reliance on side‑loading, the attack vector typically requires an adversary to compromise or place malicious code near a trusted executable – either by exploiting supply chain attacks, social engineering, or compromised development pipelines.

Key Capabilities

• DLL side‑loading in same directory as legitimate executable
• Malicious code execution within a trusted process context
• Process injection into running applications
• Persistence through scheduled tasks or registry Run keys
• Credential theft and lateral movement support
• Obfuscation of malicious DLLs with benign naming

ATT&CK Techniques

Recommended Actions

• Monitor for unusually named DLLs in directories containing trusted executables using Sysmon logs (Event ID 7045)
• Implement strict application whitelisting to block execution of untrusted DLLs alongside legitimate applications
• Deploy file integrity monitoring to detect new or modified binaries next to critical system programs
• Regularly audit registry Run Keys and Scheduled Tasks for unauthorized entries
• Configure Endpoint Detection & Response (EDR) to alert on Process Injection behaviors

Suggested Tags