Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

WatchGuard details three Windows campaigns using DLL side-loading

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

WatchGuard describes three separate Windows phishing campaigns that hide malware with fake error-reporting tasks and DLL side-loading.

WatchGuard described three Windows campaigns that combine phishing, obfuscated VBScript, PowerShell, and legitimate binaries. Overlord impersonated Brazilian notaries and installed Overlord RAT; Lampion used financial lures, mainly in Portugal; a third chain side-loaded a malicious DLL beside legitimate programs, including a VMware utility. Attackers copied Windows Error Reporting names and paths rather than exploiting the component. WatchGuard links the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, but does not attribute the cases to one operator.

Key facts
  • Euler Neto published the WatchGuard investigation on October 22, 2026.
  • Overlord used CNPJ-personalized links, Dropbox, Google Cloud Storage, and 191.96.225.125.
  • A Go loader copied itself as WerFault.exe and created Windows Error Reporting tasks.
  • Lampion scripts were about 5 MB with roughly 5 KB of logic; 94.6% of Acronis detections were in Portugal.
  • One chain contacted 148.224.62.243:7777 and side-loaded newdev.dll beside VMware vnetlib.exe.
  • MSI samples paired malicious DLLs with ngentask.exe or VLC and contacted 45.158.8.213.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Euler Neto published the WatchGuard investigation. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersIPs, WerFault persistence, Acronis Portugal share, and side-load file names.
  • Cyber Security NewsOctober 22 publication date, Pascal payload, and no shared operator.
Vendors
VideoLANVMwareMicrosoft
Products
VLC Media PlayerVMware network installation utility
Malware
Overlord RATLampionDonut
Organizations
WatchGuardAcronisBitsight
Countries
BrazilPortugal

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    Overlord and Lampion campaigns hide malware with Windows tools

    Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.

  2. · 4d ago Cyber Security News

    VLC and VMware binaries side-load malware targeting Brazil and Portugal

    WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.