Sideloading of jli.dll in USOShared Directory

Elgonad .@elgonad

•updated Mar 20, 2026•0•22

Detects the loading of jli.dll from the C:\ProgramData\USOShared directory. This behavior is indicative of DLL sideloading via a legitimate Java process, a consistent post-exploitation tactic used by the LeakNet ransomware group.