Storm-2561 - Fake VPN DLL Sideloading and RunOnce Persistence

Lacey Cochrane@NullVectorX

•updated Mar 16, 2026•9•0•111

Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.