VLC and VMware binaries side-load malware targeting Brazil and Portugal
Original title: Hackers Use VLC Media Player and VMware Tools to Load Malware Through DLL Side-Loading
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
WatchGuard described three Windows campaigns that place malicious DLLs beside legitimate programs so those programs load attacker code. Overlord RAT targeted Brazil through fake notary notices, while a Portuguese invoice page delivered an ISO that used a genuine VMware utility as a loader. A separate Lampion banking-malware campaign used finance-themed phishing. The cases share delivery methods, but WatchGuard does not attribute them to one operator.
Unconfirmed: WatchGuard does not establish that one group controls all three operations.
- Euler Neto published the WatchGuard investigation on October 22, 2026.
- Overlord phishing impersonated Brazilian notaries and delivered VBScript, installers, or cloud-hosted files.
- One side-load used VLC; another paired a malicious DLL with a Microsoft .NET utility.
- A Portuguese “Download Seguro – Factura” page delivered an ISO with a VMware utility and malicious DLL.
- Lampion mainly targeted Portugal and hid about 5 KB of code in a roughly 5 MB script.
Impact: Remote control, screen capture, and command execution
- 1.Review process chains, persistence settings, and outbound connections.
- 2.Isolate compromised endpoints where those signs appear.
- 3.Watch for script downloads, Defender exclusions, scheduled tasks, and libraries loaded from unusual folders.
- ATT&CK
- T1574.002 DLL Side-LoadingT1566.002 Spearphishing LinkT1059.005 Visual BasicT1053.005 Scheduled TaskT1113 Screen Capture
- Malware
- Overlord RATLampionDonut
- Organizations
- WatchGuard
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 1protestorecife.com | ies failed connections every three seconds Phishing domains 1protestorecife[.]com 2protestodesalvador[.]com 3protestobelem[.]com cartorioqu |
| domain | 2protestodesalvador.com | every three seconds Phishing domains 1protestorecife[.]com 2protestodesalvador[.]com 3protestobelem[.]com cartorioquintela[.]com Domains imper |
| domain | 3protestobelem.com | ing domains 1protestorecife[.]com 2protestodesalvador[.]com 3protestobelem[.]com cartorioquintela[.]com Domains impersonating Brazilian no |
| domain | 777.sgn | umber Payload location storage[.]googleapis[.]com/win777win/777[.]sgn Download location associated with the Overlord delivery c |
| domain | agent.sgn | Payload URL hxxps://storage[.]googleapis[.]com/protesto-att/agent[.]sgn Encrypted content downloaded as werdata.db ; report also |
| domain | cartorioquintela.com | recife[.]com 2protestodesalvador[.]com 3protestobelem[.]com cartorioquintela[.]com Domains impersonating Brazilian notary offices Phishing d |
| domain | cartoriosdeprotestogo.com | ins impersonating Brazilian notary offices Phishing domains cartoriosdeprotestogo[.]com protestobh[.]com protestocampinas[.]com tabelionatojoinvi |
| domain | protestobh.com | notary offices Phishing domains cartoriosdeprotestogo[.]com protestobh[.]com protestocampinas[.]com tabelionatojoinville[.]com Additio |
| domain | protestocampinas.com | ishing domains cartoriosdeprotestogo[.]com protestobh[.]com protestocampinas[.]com tabelionatojoinville[.]com Additional notary impersonatio |
| domain | resolvecenprot.com | esto-att/7seven7.bat Batch script download Lure URL hxxps://resolvecenprot[.]com/pdf URL defined in an obfuscated VBScript Payload URL hxx |
| domain | storage.googleapis.com | lid Brazilian business registration number Payload location storage[.]googleapis[.]com/win777win/777[.]sgn Download location associated with t |
| domain | tabelionatojoinville.com | sdeprotestogo[.]com protestobh[.]com protestocampinas[.]com tabelionatojoinville[.]com Additional notary impersonation domains Phishing URL patt |
| ipv4 | 148.224.62.243 | ion from side-loaded DLLs; port 5173 Command-and-control IP 148[.]224[.]62[.]243:7777 Pascal payload command server; retries failed co |
| ipv4 | 191.96.225.125 | oCs):- Type Indicator Source context Command-and-control IP 191[.]96[.]225[.]125 Overlord RAT infrastructure; report associates the ca |
| ipv4 | 45.158.8.213 | sociates the campaign with port 5173 Command-and-control IP 45[.]158[.]8[.]213 Overlord RAT communication from side-loaded DLLs; por |
| url | https://resolvecenprot.com/pdf | com/protesto-att/7seven7.bat Batch script download Lure URL hxxps://resolvecenprot[.]com/pdf URL defined in an obfuscated VBScript Payload URL hxxps:/ |
| url | https://resolvecenprot.com/pdfatt/agent777.msi | [.]com/protesto-att/agent777.msi MSI delivery Installer URL hxxps://resolvecenprot[.]com/pdfatt/agent777.msi Alternative MSI delivery location Filenames Update.exe / |
| url | https://storage.googleapis.com/protesto-att/7seven7.bat | tion associated with the Overlord delivery chain Script URL hxxps://storage[.]googleapis[.]com/protesto-att/7seven7.bat Batch script download Lure URL hxxps://resolvecenprot[. |
| url | https://storage.googleapis.com/protesto-att/agent777.msi | pis[.]com/protesto-att/agent.msi MSI delivery Installer URL hxxps://storage[.]googleapis[.]com/protesto-att/agent777.msi MSI delivery Installer URL hxxps://resolvecenprot[.]com |
| url | https://storage.googleapis.com/protesto-att/agent.msi | is[.]com/protesto-att/update.msi MSI delivery Installer URL hxxps://storage[.]googleapis[.]com/protesto-att/agent.msi MSI delivery Installer URL hxxps://storage[.]googleapis |
| url | https://storage.googleapis.com/protesto-att/agent.sgn | .]com/pdf URL defined in an obfuscated VBScript Payload URL hxxps://storage[.]googleapis[.]com/protesto-att/agent[.]sgn Encrypted content downloaded as werdata.db ; report a |
| url | https://storage.googleapis.com/protesto-att/update.msi | as werdata.db ; report also mentions 777.sgn Installer URL hxxps://storage[.]googleapis[.]com/protesto-att/update.msi MSI delivery Installer URL hxxps://storage[.]googleapis |
From the original article
5 min read at cybersecuritynews.com
Hackers are using legitimate VLC Media Player and VMware components to load malware onto Windows systems, hiding harmful code behind familiar software. The activity forms part of three malware campaigns targeting users in Brazil and Portugal through fake legal notices, financial documents, and invoice download pages. The attacks combine phishing, hidden scripts, and trusted programs […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.