ReversingLabs blog
Lazarus DLL sideloading via IDA Pro library (mentioned in "Attackers leverage PyPI to sideload malicious DLLs") · 2024-02-20T06:00:00.000Z
In one prominent example, the North Korea-linked Lazarus Group used DLL sideloading to replace an internal IDA Pro library, win_fw.dll, with a malicious DLL to download and execute a payload.