# T1055.001 Dynamic-link Library Injection

> As of 2026-10-05, T1055.001 (Dynamic-link Library Injection) appears in 25 tracked threats, first reported 2021-11-25 and most recently 2026-09-26, with linked actors including APT38, Andariel, Lazarus Group; it most often appears alongside T1027 (Obfuscated Files or Information).

- **Tracked threats:** 25 (5 critical, 15 high, 5 medium)
- **First seen:** 2021-11-25
- **Last seen:** 2026-09-26
- **Threat actors:** 15
- **Detection rules:** 56 (counts only; Blue tier and above)

## Key facts

- **ID:** T1055.001
- **Framework:** MITRE ATT&CK
- **Tactics:** Privilege Escalation, Stealth (formerly Defense Evasion)
- **Matrix:** Enterprise
- **Parent:** T1055
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1055/001/

## Activity timeline

T1055.001 first appeared in tracked threats on 2021-11-25 and was most recently reported on 2026-09-26. The busiest month was 2026-07 with 7 reports, and 24 of the 25 threats were reported in the twelve months to 2026-09.

## How adversaries use it

T1055.001 Dynamic-link Library Injection is catalogued by MITRE ATT&CK under the Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of [T1055 Process Injection](https://intel.threadlinqs.com/technique/T1055). Threadlinqs maps 25 of 2623 tracked threats (1%) to it; by severity that is 5 critical, 15 high, 5 medium.

Threats that use T1055.001 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (20 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (19 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (18 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (17 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (17 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

15 tracked threat actors appear in the threats that use T1055.001; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (2), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (2), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (2), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (2), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (2).

## Mitigations

MITRE ATT&CK lists 1 mitigation for T1055.001.

- [M1040 Behavior Prevention on Endpoint](https://attack.mitre.org/mitigations/M1040/)

## Data sources

Telemetry that can reveal T1055.001, per MITRE ATT&CK.

- Module — Module Load
- Process — OS API Execution, Process Access, Process Metadata, Process Modification

## Threat actors using it

- [APT38](https://intel.threadlinqs.com/actor/APT38) — 2
- [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 2
- [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 2
- [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 2
- [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 2
- [APT37](https://intel.threadlinqs.com/actor/APT37) — 1
- [GhostEmperor](https://intel.threadlinqs.com/actor/GhostEmperor) — 1
- [LenAI](https://intel.threadlinqs.com/actor/LenAI) — 1
- [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 1
- [Magecart](https://intel.threadlinqs.com/actor/Magecart) — 1
- [Nightmare Eclipse](https://intel.threadlinqs.com/actor/Nightmare%20Eclipse) — 1
- [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1

## Tracked threats

25 tracked threats use T1055.001.

- [Kothamine RAT Abuses Tailscale's Tailcat for Encrypted C2, Distributed via Malicious npm Packages](https://intel.threadlinqs.com/threat/TL-2026-2665) — high — 2026-09-26
- [Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems](https://intel.threadlinqs.com/threat/TL-2026-2612) — medium — 2026-09-22
- [ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport…](https://intel.threadlinqs.com/threat/TL-2026-2387) — critical — 2026-09-08
- [FalconFlank — CrowdStrike Falcon Sensor Local Privilege Escalation Zero-Day with Public PoC](https://intel.threadlinqs.com/threat/TL-2026-2350) — high — 2026-09-06
- [HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege…](https://intel.threadlinqs.com/threat/TL-2026-2258) — medium — 2026-08-31
- [TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency](https://intel.threadlinqs.com/threat/TL-2026-2133) — high — 2026-08-24
- [Chinese-speaking threat group UAT-10147 uses agentic AI to automate exploitation of internet-facing web…](https://intel.threadlinqs.com/threat/TL-2026-2096) — high — 2026-08-21
- [GEEKOM Mini PC Legacy Support Page Distributed Trojanized Realtek LAN Driver Infected with Asruex](https://intel.threadlinqs.com/threat/TL-2026-2059) — medium — 2026-08-18
- [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…](https://intel.threadlinqs.com/threat/TL-2026-1987) — critical — 2026-08-11
- [Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)](https://intel.threadlinqs.com/threat/TL-2026-1908) — critical — 2026-08-06
- [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — medium — 2026-07-22
- [DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaigns](https://intel.threadlinqs.com/threat/TL-2026-1485) — medium — 2026-07-18
- [AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver…](https://intel.threadlinqs.com/threat/TL-2026-1344) — high — 2026-07-15
- [AtlasRAT: Memory-Only Multi-Stage Loader Chain Disguised as AGE Flash Player](https://intel.threadlinqs.com/threat/TL-2026-1343) — high — 2026-07-14
- [BoryptGrab Infostealer Campaign Abuses ~292 Fake GitHub Repos Impersonating Legitimate Software](https://intel.threadlinqs.com/threat/TL-2026-1338) — high — 2026-07-14
- [Operation Capsule Vault: APT37 Weaponizes Real Academic Event Materials to Deliver RokRAT via ISO/Process…](https://intel.threadlinqs.com/threat/TL-2026-1285) — high — 2026-07-13
- [JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux…](https://intel.threadlinqs.com/threat/TL-2026-1142) — high — 2026-07-06
- [RenEngine Loader — Pirated Game Installers Abuse Ren'Py Python Launchers + DLL Side-Loading to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-0716) — high — 2026-06-08
- [FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading…](https://intel.threadlinqs.com/threat/TL-2026-0509) — critical — 2026-05-13
- [Operation GriefLure — China-Nexus APT Spear-Phishing Targeting Viettel (Vietnam Military Telecom) and St.…](https://intel.threadlinqs.com/threat/TL-2026-0476) — high — 2026-05-07
- [GopherWhisper — China-Aligned APT Targeting Mongolian Government with Go-Based Burrow Malware Toolkit…](https://intel.threadlinqs.com/threat/TL-2026-0419) — high — 2026-04-24
- [Trojanized Slack Installer Deploys HVNC Backdoor via Typosquatted Domain (slacks.pro)](https://intel.threadlinqs.com/threat/TL-2026-0374) — high — 2026-04-16
- [UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via…](https://intel.threadlinqs.com/threat/TL-2026-0171) — high — 2026-03-02
- [Aeternum C2 Botnet — Polygon Blockchain Smart Contract C2, Takedown-Resistant Infrastructure, LenAI MaaS](https://intel.threadlinqs.com/threat/TL-2026-0151) — critical — 2026-02-27
- [NginRAT/CronRAT Server-Side Magecart Campaign — NGINX LD_PRELOAD Process Parasitism, Impossible Cron Date…](https://intel.threadlinqs.com/threat/TL-2026-0095) — high — 2021-11-25

## Related CVEs

CVEs referenced by the tracked threats that use T1055.001, most frequent first.

- [CVE-2017-8291](https://intel.threadlinqs.com/cve/CVE-2017-8291)
- [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379)
- [CVE-2019-16098](https://intel.threadlinqs.com/cve/CVE-2019-16098)
- [CVE-2019-18935](https://intel.threadlinqs.com/cve/CVE-2019-18935)
- [CVE-2021-23758](https://intel.threadlinqs.com/cve/CVE-2021-23758)
- [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441)
- [CVE-2022-0847](https://intel.threadlinqs.com/cve/CVE-2022-0847)
- [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925)
- [CVE-2022-37042](https://intel.threadlinqs.com/cve/CVE-2022-37042)
- [CVE-2022-41040](https://intel.threadlinqs.com/cve/CVE-2022-41040)
- [CVE-2022-41082](https://intel.threadlinqs.com/cve/CVE-2022-41082)
- [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669)
- [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350)
- [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966)
- [CVE-2023-4967](https://intel.threadlinqs.com/cve/CVE-2023-4967)
- [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113)
- [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088)
- [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040)
- [CVE-2026-68820](https://intel.threadlinqs.com/cve/CVE-2026-68820)

## Detection coverage

Threadlinqs maintains 56 detection rules mapped to T1055.001 (SPL 19, KQL 18, Sigma 19). Rule content is available to Blue tier accounts and above; this page shows counts only.

56 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1055 Process Injection](https://intel.threadlinqs.com/technique/T1055) — 269 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1055.001
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)