Activity timeline
T1055.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 24 of the 25 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1055.001 Dynamic-link Library Injection is catalogued by MITRE ATT&CK under the Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1055 Process Injection. Threadlinqs maps 25 of 2623 tracked threats (1%) to it; by severity that is 5 critical, 15 high, 5 medium.
Threats that use T1055.001 most often also use T1027 Obfuscated Files or Information (20 threats), T1071.001 Web Protocols (19 threats), T1082 System Information Discovery (18 threats), T1036.005 Match Legitimate Resource Name or Location (17 threats), T1140 Deobfuscate/Decode Files or Information (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
15 tracked threat actors appear in the threats that use T1055.001; the most frequent are APT38 (2), Andariel (2), Lazarus Group (2), Sapphire Sleet (2), Stardust Chollima (2).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1055.001.
Data sources
Telemetry that can reveal T1055.001, per MITRE ATT&CK.
- Module — Module Load
- Process — OS API Execution, Process Access, Process Metadata, Process Modification
Threat actors using it
Tracked threats
25 tracked threats use T1055.001.
- Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packageshigh
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systemsmedium
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport…critical
- FalconFlank — CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day with Public PoChigh
- HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege…medium
- TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparencyhigh
- Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web…high
- GEEKOM Mini PC Legacy Support Page Distributed Trojanized Realtek LAN Driver Infected with Asruexmedium
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…critical
- Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)critical
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demandsmedium
- DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaignsmedium
- AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…high
- AtlasRAT: Memory-Only Multi-Stage Loader Chain Disguised as AGE Flash Playerhigh
- BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Softwarehigh
- Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process…high
- JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux…high
- RenEngine Loader — Pirated Game Installers Abuse Ren'Py Python Launchers + DLL Side-Loading to Deliver…high
- FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading…critical
- Operation GriefLure — China-Nexus APT Spear-Phishing Targeting Viettel (Vietnam Military Telecom) and St.…high
- GopherWhisper — China-Aligned APT Targeting Mongolian Government with Go-Based Burrow Malware Toolkit…high
- Trojanized Slack Installer Deploys HVNC Backdoor via Typosquatted Domain (slacks.pro)high
- UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via…high
- Aeternum C2 Botnet — Polygon Blockchain Smart Contract C2, Takedown-Resistant Infrastructure, LenAI MaaScritical
- NginRAT/CronRAT Server-Side Magecart Campaign — NGINX LD_PRELOAD Process Parasitism, Impossible Cron Date…high
Detection coverage
Threadlinqs maintains 56 detection rules mapped to T1055.001 (SPL 19, KQL 18, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1055 Process Injection — 269 tracked threats at the technique level.