Red Lamassu JFMBackdoor DLL Side-Loading via fltMC.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects DLL side-loading activity associated with the JFMBackdoor malware. The rule identifies the execution of the legitimate Windows filter manager control utility (fltMC.exe) from suspicious locations (TEMP/tmp directories) and the creation of companion payloads (FLTLIB.dll, flt.bin, or scr.mui) in those same directories, which are characteristic of the JFMBackdoor dropper chain.