DLL sideloading via renamed Sangfor binary defender.exe loading libngs.dll

Ethan Andrews@eandrews

•updated Aug 17, 2026•5•1•13

Detects DLL sideloading behavior where a process named defender.exe, located in a directory mimicking the Windows Defender installation path, loads specific DLLs (libngs.dll or libsrapc.dll) associated with the HoneyMyte actor's CoolClient malware.