TA4922 RomulusLoader DLL Sideloading via vulkan-1.dll or Unsigned DLL from Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects suspected RomulusLoader activity by identifying the sideloading of 'vulkan-1.dll' from non-standard directories, the creation of encrypted 'vulkan-1.bin' payload files, and the loading of unsigned DLLs from user-writable directories (Temp/AppData) by otherwise signed processes.