← Threat archive

T1620 Reflective Code Loading

3 threats tracked by Spectrum Delta use this technique.

T1620 on MITRE ATT&CK →

  • Sirius backdoor FedEx fileless

    Fileless .NET staging via reflection

    EID 4104 script blocks (the unpacker is PowerShell); the .NET stages are not script blocks - visible to EDR memory scanning, not to script logging

    Seen in: PowerShell script block logging

  • APT28 Hookedge NATO campaign

    Reflective code loading: ld.exe with runtime decryption key

    Windows process-creation events: ld.exe executing with a hex key and .dat file as arguments from ProgramData; the SHA-256 is published for IOC matching

    Seen in: Windows EDR / Sysmon process+file

  • Lazarus FlashHole

    LPEClient reflective in-memory payload loading

    EDR memory/injection telemetry: reflective MZ payload loading in LPEClient/ClientHub processes (visibility depends on EDR instrumentation); the ML-KEM-1024/Threefish/GOST exchange is source-attested context, not directly observable

    Seen in: Sysmon / EDR