SLOW#TEMPEST DLL Sideloading via DingTalk

R W@shiftyroot

•updated Jul 23, 2025•1•19

This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.