{"id":1490,"date":"2025-12-18T02:46:12","date_gmt":"2025-12-18T02:46:12","guid":{"rendered":"https:\/\/blog.scilabs.mx\/en\/?p=1490"},"modified":"2025-12-18T02:46:13","modified_gmt":"2025-12-18T02:46:13","slug":"bpl-side-loading-technique-exploited-by-threat-actors-in-latam","status":"publish","type":"post","link":"https:\/\/blog.scilabs.mx\/en\/2025\/12\/18\/bpl-side-loading-technique-exploited-by-threat-actors-in-latam\/","title":{"rendered":"BPL Side-Loading: technique exploited by threat actors in LATAM"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

The purpose of this post is to provide information on a technique disclosed in May of 2024 and recorded on multiple open feeds<\/a> due to its continued use by some known and unknown threat groups (such as Red Akodon<\/a><\/em>, which was profiled by SCILabs in April of 2024).<\/p>\n\n\n\n

Since mid-2024, SCILabs has consistently identified artifacts used in malware campaigns targeting LATAM that are executed during the infection process through the BPL Side-Loading<\/a> technique in conjunction with IDATLoader<\/a><\/em> malware. Most of these artifacts are distributed via phishing emails.<\/p>\n\n\n\n

The information provided here focuses on disclosing some of the malware campaigns primarily affecting Colombia, and potentially other LATAM countries, leveraging email pretexts such as alleged legal demands and citations, as well as a campaign impersonating a Crowdstrike update after the July 19, 2024 incident<\/a>, when the provider released a configuration content update for its Windows sensor (part of the Falcon Sensor platform) that resulted in critical operating system failures (Blue Screen of Death [BSOD<\/a>]) in some Windows hosts.<\/p>\n\n\n\n

It is important to notice that this information aims to explain how BPL Side-Loading is exploited in conjunction with IDATLoader<\/em> malware, with the objective of understanding recent malware campaigns under the premise that these techniques will likely continue to be employed constantly by threat actors in the future.<\/p>\n\n\n\n

How can this affect your organization?<\/h2>\n\n\n\n

BPL Side-Loading has been previously recorded publicly; however, it hasn\u2019t received enough coverage nor sufficient in-depth analysis. This technique would allow an attacker to deploy any kind of malware, evading security controls such as EDR and AV. Consequently, organizations lacking prior knowledge of this technique and its functionality are unable to implement effective security countermeasures, which may lead to integrity, confidentiality and availability risks, leading to financial losses and reputational damage.<\/p>\n\n\n\n

Technical analysis<\/h2>\n\n\n\n

First campaign<\/strong><\/p>\n\n\n\n

This campaign was found through open feed posts<\/a> where the distribution method was determined to be phishing emails using a pretext of a supposed legal citation impersonating the \u201cFiscal\u00eda General de la Naci\u00f3n<\/em>\u201d of Colombia.<\/p>\n\n\n

\n
\"\"
Image 1. Image found in open sources<\/a> depicting the phishing email template<\/figcaption><\/figure><\/div>\n\n\n

This email has a ZIP file attached by the name of \u201c08 CITACION DEMANDA.zip<\/em>\u201d, which works as the first dropper.<\/p>\n\n\n

\n
\"\"
Image 2. Files attached to the compressed file<\/figcaption><\/figure><\/div>\n\n\n

We\u2019ll provide a brief description of the artifacts identified inside the ZIP file, as their full analysis is not the main objective of this post. The focus is to understand their role in exploiting the BPL Side-Loading technique. Moreover, we will examine the functionality of the highlighted artifacts further down the post.<\/p>\n\n\n\n