T1055.012 - Process Hollowing

MITRE ATT&CK

Threat entity extracted from intelligence sources

Entities›MITRE ATT&CK›T1055.012 - Process Hollowing

Frequency

occurrences

First Seen

November 6, 2025

Last Seen

August 21, 2026

API

Overview

Recent Events

Profile

1 / 2

REC

Recon

No techniques detected

Resource Dev

No techniques detected

Initial Access

T1566.001 - Spearphishing AttachmentT1190 - Exploit Public-Facing Application

Execution

T1059.001 - PowerShellT1053 - Scheduled Task/JobT1047 - Windows Management Instrumentation

Persistence

T1543.003 - Windows ServiceT1574 - Hijack Execution FlowT1547 - Boot Or Logon Autostart ExecutionT1505.003 - Web Shell

Priv Esc

T1055 - Process InjectionT1548.002 - Bypass User Account ControlT1068 - Exploitation for Privilege Escalation

Defense Evasion

T1027 - Obfuscated Files Or InformationT1112 - Modify RegistryT1036 - MasqueradingT1562.001 - Disable Or Modify Tools

Cred Access

T1003 - OS Credential Dumping

Discovery

T1057 - Process DiscoveryT1083 - File And Directory Discovery

Lateral Mov

T1021 - Remote Services

Collection

No techniques detected

T1071 - Application Layer ProtocolT1105 - Ingress Tool Transfer

Exfil

T1041 - Exfiltration Over C2 Channel

Impact

T1490 - Inhibit System Recovery

33 techniques detected across 11 tactics

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (25)

FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

Jun 16·12 sources

UAT-10147 Cybercrime Group Integrates AI for Large-Scale Attacks

Aug 20·10 sources

UAT-10147 Threat Actor Deploys SPECTRE Backdoor with AI and EDR Bypass Techniques

Aug 24·2 sources

Malicious Background Removal Tool Distributes RATs and Infostealers

May 1·3 sources

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers

Jul 1·7 sources

Phishing Campaign Deploys PureLogs Variant via JavaScript and MsBuild Injection

May 27·7 sources

New Remcos RAT Campaign Exploits CVE-2017-11882 via Phishing

May 29·2 sources

TrickBot Malware Adopts DNS Tunneling for Command-and-Control Communication

Jul 22·3 sources

Cryptojacking Malware Exploits AI Chatbots and SEO Poisoning

May 27·19 sources

BlackSanta Campaign Targets HR with Malware-laden Job Applications

Mar 10·7 sources

Exposed Malware Delivery Lab Reveals AI-Driven Phishing Operations

Jul 20·2 sources

Phishing Campaign Exploits Google Storage to Deploy Remcos RAT

Apr 9·6 sources

DesckVB RAT Campaign Exploits Google DoubleClick for Malspam Delivery

Jun 3·6 sources

LockBit Ransomware Group Launches New Data Leak Site and Upgrades to Version 5.0

Dec 5·3 sources

Malware Distribution via Fake Video Player Updates on Pirated Streaming Sites

May 29·3 sources

NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods

Apr 16·3 sources

Emerging Threat: Kiss Loader Malware Exploits Early Bird APC Injection

Mar 26·4 sources

PureRAT Campaign Uses PNGs for Stealthy Fileless Attacks

Apr 21·2 sources

XWorm RAT Exploits CVE-2018-0802 in Phishing Campaign

Feb 12·1 sources

DeadLock Ransomware Employs BYOVD Technique to Bypass Security

Dec 10·3 sources

MuddyWater APT Launches New Rust Malware Against Israeli Targets

Feb 24·25 sources

XWorm 7.2 Malware Campaign Targets Businesses via Phishing Emails

Feb 24·2 sources

RenEngine Loader Malware Infects Over 400,000 Devices via Pirated Games

Feb 11·6 sources

New Malware Campaign Targets Manufacturing and Government Sectors

Dec 22·4 sources

Phishing Campaign Deploys Agent Tesla via Process Hollowing Techniques

Feb 26·2 sources

1 / 5

Related Entities

Apt-c-36 Aquatic Panda Earth Lusca FishMonger G0069 Mango Sandstorm MenuPass MuddyWater Patchwork Red Dev 10 Seedworm Stealth Falcon

T1055.012 - Process Hollowing

Overview

Recent Events

Profile

Exploited By

Associated Malware

Tools Used

Campaigns

Affected Platforms

Regions

Sectors Affected

Relationships

Related Clusters (25)

FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

UAT-10147 Cybercrime Group Integrates AI for Large-Scale Attacks

UAT-10147 Threat Actor Deploys SPECTRE Backdoor with AI and EDR Bypass Techniques

Malicious Background Removal Tool Distributes RATs and Infostealers

Widespread Abuse of ScreenConnect to Deploy AsyncRAT via Fake Installers

Phishing Campaign Deploys PureLogs Variant via JavaScript and MsBuild Injection

New Remcos RAT Campaign Exploits CVE-2017-11882 via Phishing

TrickBot Malware Adopts DNS Tunneling for Command-and-Control Communication

Cryptojacking Malware Exploits AI Chatbots and SEO Poisoning

BlackSanta Campaign Targets HR with Malware-laden Job Applications

Exposed Malware Delivery Lab Reveals AI-Driven Phishing Operations

Phishing Campaign Exploits Google Storage to Deploy Remcos RAT

DesckVB RAT Campaign Exploits Google DoubleClick for Malspam Delivery

LockBit Ransomware Group Launches New Data Leak Site and Upgrades to Version 5.0

Malware Distribution via Fake Video Player Updates on Pirated Streaming Sites

NWHStealer Malware Campaign Exploits Trust in Fake VPNs and Game Mods

Emerging Threat: Kiss Loader Malware Exploits Early Bird APC Injection

PureRAT Campaign Uses PNGs for Stealthy Fileless Attacks

XWorm RAT Exploits CVE-2018-0802 in Phishing Campaign

DeadLock Ransomware Employs BYOVD Technique to Bypass Security

MuddyWater APT Launches New Rust Malware Against Israeli Targets

XWorm 7.2 Malware Campaign Targets Businesses via Phishing Emails

RenEngine Loader Malware Infects Over 400,000 Devices via Pirated Games

New Malware Campaign Targets Manufacturing and Government Sectors

Phishing Campaign Deploys Agent Tesla via Process Hollowing Techniques

Related Articles (30)

UAT-10147 SPECTRE Uses Linux Rootkit and BYOVD

UAT-10147 deploys SPECTRE: A cross

TrickBot Ditches HTTP for DNS Tunneling in Latest Variant

Inside an Exposed Malware Delivery Lab: OPSEC Failures Behind a WebDAV Phishing Operation

The SOC Files: ScreenConnect masked as freeware. An inside look at a large

Fishmongers Arsenal Upgraded Sprysocks Windows

New malspam campaign uses Google DoubleClick to deliver DesckVB RAT

New Remcos Campaign Distributed Through Fake Shipping Document

Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years

New PureLogs Variant Abuses MSBuild to Evade Detection

GPU mining malware spreads via SEO poisoning, AI chatbots

Microsoft Warns of New Mining Malware Targeting High-Performance PC Users

ClickFix Removes Your Background but Leaves the Malware

PureRAT Hides PE Payloads in PNGs for Fileless Execution

NWHStealer Spreads via Fake Proton VPN and Game Mods

New Phishing Campaign Exploits Google Storage to Deliver Remcos RAT

Phishing via Google Storage Abuse Leading to RAT Deployment

Kiss Loader Malware Targets with Early Bird APC Injection in New Attack Campaign

Kernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows

Phishing‑Led Agent Tesla Campaign Uses Process Hollowing and Anti‑Analysis to Evade Detection

XWorm malware campaign leverages business-themed for PC infections

Iranian MuddyWater APT Targets Israeli Government and Infrastructure With Advanced Rust ...

XWorm Phish Abuses CVE-2018-0802 for Fileless RAT

Global RenEngine Loader attack campaign examined

Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns

Sophisticated malware campaign leverages shared loader

Sophisticated Attack Campaign Exposes Loader Used by Multiple Threat Actors

DeadLock Ransomware Uses BYOVD to Evade Security Measures

Modularity advances LockBit 5.0 ransomware

LockBit 5.0 Analysis: Technical Deep Dive into the RaaS Giant's Latest Upgrade

Related Entities