Dropping Elephant VLC Side-Loading and Staging

Aaron Mog@AaronMogS2S

•updated Jul 25, 2025•2•20

Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.