Obsidian Sandstorm DLL Sideloading - Legit Process Loads DLL from User-Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects DLL sideloading behavior where a legitimate, signed executable (e.g., in System32 or Program Files) loads a DLL from a non-standard, user-writable directory (e.g., Temp, AppData, Downloads). This pattern is consistent with the delivery of Obsidian Sandstorm (Storm-2571) payloads such as ThrottleDrift, RiverGorilla, and SilverGorilla, where malicious DLLs are staged and loaded alongside trusted binaries.