Bleepingcomputer

PDFSider Malware Targets Fortune 100 Finance Firm with Covert Backdoor Access

First seen 20 Jan 2026, 02:03 UTC • Infosecurity-Magazine

•30.6

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A new malware strain named PDFSider has been deployed on the network of a Fortune 100 company in the finance sector. The attackers utilized social engineering tactics to gain remote access and installed an encrypted backdoor via DLL side-loading, designed to evade detection and maintain long-term access. Researchers from Resecurity identified this malware during an incident response.

How this analysis works

Attack Flow

14 entities, 13 inferred relationships (STIX 2.1).

Technique (7)

Malware
Phishing
Ransomware
DLL Side-loading
T1059 - Command and Scripting Interpreter
T1071.004 - DNS
T1566 - Spearphishing Attachment

Malware (1)

Pdfsider

Affected Platform (2)

Pdf24 App
Windows

Threat Actor (1)

Qilin

Tool (3)

Cmd.exe
Microsoft Quick Assist
Pdf24 Creator

Relationships

Qilin uses Pdfsider
Qilin uses Cmd.exe
Qilin uses Microsoft Quick Assist
Qilin uses Pdf24 Creator
Qilin uses Malware
Qilin uses Phishing
Qilin uses Ransomware
Qilin uses DLL Side-loading
Qilin uses T1059 - Command and Scripting Interpreter
Qilin related to T1071.004 - DNS
Qilin related to T1566 - Spearphishing Attachment
Qilin related to Pdf24 App
Qilin related to Windows

Continue Reading

Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million Inotiv Confirms Data Breach from August 2025 Ransomware Attack Critical Check Point VPN Vulnerability Exploited by Ransomware Gang Russia's Hybrid Warfare Threatens UK with Cyberattacks and Sabotage MuddyWater Targets U.S. Entities Amid Geopolitical Tensions Synnovis Reports Data Breach Following June 2024 Ransomware Attack

PDFSider Malware Targets Fortune 100 Finance Firm with Covert Backdoor Access

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading