TA4922 RomulusLoader In-Memory Staging via Cross-Process Injection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential malicious activity including unsigned processes performing cross-process injection into common system processes, suspicious sideloading of 'vulkan-1.dll' from non-standard locations, and execution of unsigned binaries from user-writable directories like Temp, AppData, or ProgramData.