PDFSIDER Backdoor Evades Antivirus and EDR

Threat actors are increasingly deploying a stealthy new tool, as the PDFSIDER backdoor evades antivirus and EDR systems by blending with trustworthy software and encrypting its communication. Security researchers at Resecurity discovered the malware during an attempted breach of a Fortune 100 enterprise, where attackers failed to cause data loss.

PDFSIDER leverages a spear-phishing campaign that delivers a ZIP file containing a valid PDF24 Creator executable and malicious components. When victims run the app, a trojanized cryptbase.dll file executes instead of legitimate content, triggering a covert infection.

The malware operates entirely in memory, launches cmd.exe with no visible window, and transmits results over AES 256-GCM encrypted DNS traffic. These techniques minimize detection by traditional security tools.

Ransomware operators and advanced attackers are already using the malware to bypass defenses. Researchers warn that the PDFSIDER backdoor evades antivirus consistently through DLL sideloading and encrypted shell access.

Read the full report at

PDFSIDER Malware Actively Used by Threat Actors to Bypass Antivirus and EDR Systems