EggStreme fileless malware framework with DLL sideloading
Malware Activity
Summary
Hide ▲
Show ▼
A newly documented EggStreme malware activity is enabling persistent access and data exfiltration on infected systems through a fileless, multi-stage framework. The framework uses DLL sideloading and in-memory execution to stay low-profile, while its backdoor can drive reconnaissance, lateral movement, and keylogging. First signs of the activity were seen in early 2024, indicating a long-running intrusion toolset rather than a one-off payload.
Related Happenings
QWCrypt and RedLoader multi-stage ransomware activity
Malware Activity
H score32
First: 09.12.2025 11:35
Last: 09.12.2025 11:35
Sources 1
About this happening:
The QWCrypt ransomware chain now matters because it has reached successful deployment in at least three attacks, using RedLoader and a customized Terminator to...
QWCrypt and RedLoader multi-stage ransomware activity
Malware ActivityAbout this happening: The QWCrypt ransomware chain now matters because it has reached successful deployment in at least three attacks, using RedLoader and a customized Terminator to...
Philippines-based military company hit by data theft breach
Incident
H score29
First: 10.09.2025 18:46
Last: 10.09.2025 18:46
Sources 1
How related:
An advanced persistent threat (APT) group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme.
About this happening:
A Philippines-based military company was compromised with the previously undocumented EggStreme fileless framework, exposing an organization tied to sensitive military...
Philippines-based military company hit by data theft breach
IncidentHow related: An advanced persistent threat (APT) group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme.
About this happening: A Philippines-based military company was compromised with the previously undocumented EggStreme fileless framework, exposing an organization tied to sensitive military...
Timeline
-
10.09.2025 18:46 2 articles · 10mo ago
Initial report: EggStreme fileless malware framework with DLL sideloading
Initial DisclosureThe first stage profiles the host, opens command-and-control communication, and starts the loader chain that establishes persistence. That opening sequence sets up the in-memory payload flow used for later reconnaissance and theft.
Show sources
- Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems — thehackernews.com — 10.09.2025 18:46
- Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems — thehackernews.com — 10.09.2025 18:46