JFMBackdoor Screen Capture via GDI DLL Load from Writable Process Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the loading of graphics-related DLLs (gdiplus.dll, gdi32.dll, gdi32full.dll) by processes executing from typically writable directories such as Temp, AppData, or ProgramData. This behavior is consistent with the screen capture functionality of the JFMBackdoor (Red Lamassu), which utilizes these libraries to capture, encode, and stage screen images.