Operation DragonReturn DLL Sideload via COU_ITR-1_to_4_AY2026-27.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects DLL sideloading behavior associated with Operation DragonReturn, where the malicious executable COU_ITR-1_to_4_AY2026-27.exe launches or drops malicious components (nvdaHelperRemote.dll or Mixed Reality.exe) within the Windows Media Player directory.