DLL Sideloading via version.dll in WinSCP: Search Order Exploitation, Rust Proxy and Payload Interception
WinSCP loads version.dll from its own folder because Windows follows a deterministic DLL search order that begins with the application directory (AppDir). Researchers published a detailed analysis showing how to detect this vector through static import table review, Known DLLs filtering, and dynamic tracing with Procmon.
The technique mirrors a recent campaign that distributed a trojanized FileZilla build through the fake domain filezilla-project.live, again abusing version.dll. The same actors later compromised the CPUID supply chain (CPU-Z and HWMonitor) using cryptbase.dll.
DLL Search Order and Known DLLs
Windows checks AppDir first, then System32/SysWOW64, and finally PATH. Known DLLs registered under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs are loaded exclusively from the system directory, bypassing AppDir entirely. version.dll is absent from this list, leaving it vulnerable to sideloading when placed next to WinSCP.exe.
Static analysis with PE-Bear and the lief Python library revealed that WinSCP.exe directly imports only three functions from version.dll: GetFileVersionInfoSizeW, GetFileVersionInfoW, and VerQueryValueW. This small surface makes proxy implementation straightforward.
Proof-of-Concept Implementation
The Rust cdylib proxy exports all 17 functions of the original library. Fourteen are forwarded at link time via a generated proxy.def file that points to C:\Windows\SysWOW64\version.dll for x86 builds. The three hijacked functions are implemented in Rust and trigger a MessageBoxW payload from a separate thread upon first invocation.
Because WinSCP calls these functions during early initialization, the payload executes before the main application window appears. The real system DLL is loaded lazily only when the forwarded functions are first called, preserving compatibility.
The build script (build.rs) dynamically creates the .def file based on CARGO_CFG_TARGET_ARCH, ensuring correct paths for both 32-bit and 64-bit targets. Release builds enable LTO, symbol stripping, and panic=abort for minimal footprint.
Related articles
VK Introduces Security Gate: Internal AppSec Platform for Code, Dependency and Container Security
VK has detailed its internal Security Gate platform, which combines SAST, SCA, secret detection and container scanning to identify security issues across more than 40,000 repositories. The system applies custom prioritization rules, dynamic metadata analysis and an LLM-based triage module called VK Triage to reduce false positives and focus developer attention on exploitable findings. Security Gate integrates directly with corporate GitLab for automatic project onboarding, badge reporting and merge-request checks via the Fast Scanner service. It also monitors open-source dependencies for protestware, malware and reachable vulnerable methods, while supporting a wide range of languages including Python, Go, Java and Swift. Additional features include Jira linking, cross-branch triage, SBOM export and automated alerts through VK WorkSpace bots.
2.2 Million Line Vulnerability Report: What Happens After Discovery and How to Turn Findings Into Action
A massive vulnerability scan produced an 1,819-page report and a 2.2-million-row Excel file that exceeded spreadsheet limits, highlighting the gap between detection and remediation. The article explains that finding vulnerabilities accounts for only 10 percent of the work, while the remaining 90 percent involves prioritization, remediation, verification, and ensuring issues do not reappear. Research from BI.ZONE, Sber, Qualys, Cyentia Institute, Kenna Security, and Hadrian shows that organizations can typically remediate only one in ten open vulnerabilities per month and that Time-to-Exploit has dropped dramatically, with many edge-device flaws exploited on the day of disclosure. The piece stresses that continuous scanning, full infrastructure coverage including shadow IT, and separate high-frequency perimeter scans are essential because 85 percent of KEV-vulnerable assets remain unpatched at disclosure time. It recommends replacing bulky reports with concise, role-specific registries that answer four questions: what to do, where to do it, by when, and the consequences of inaction. Three legitimate outcomes for every vulnerability are outlined: patching, compensating controls, or formal risk acceptance with defined review dates, while false positives such as orphaned OpenSSL libraries must be cleaned rather than ignored.
Prepare for Summer Vacation: Patch Tuesday Overlaps with Obon Holiday Week Raises Risks
As August approaches and organizations enter summer vacation season, many will face a challenging overlap between Microsoft's Patch Tuesday and Japan's Obon holiday week in 2026. System administrators and security teams are often unavailable during extended breaks, leading to slower detection, reporting, and remediation of threats. Ransomware campaigns frequently target periods such as evenings, weekends, and consecutive holidays when response times are delayed. Experts recommend completing software updates on servers, network devices, and endpoints before departure to close known vulnerabilities. Security product definition files should be refreshed, unused systems powered down after risk assessment, and basic controls verified in advance. The advisory from Security NEXT highlights that dispersed vacation schedules in some organizations still leave concentrated risk windows for others.
Critical Remote Code Execution Flaw Patched in Veeam ONE Backup Management Product
Veeam Software disclosed six vulnerabilities in its backup environment operations management product Veeam ONE on July 29, 2026. The most severe issue, tracked as CVE-2026-64633, permits unauthenticated remote code execution on the agent host and received a maximum CVSS v4.0 base score of 10.0, rated Critical. A second flaw, CVE-2026-58075, allows unauthenticated arbitrary file reads that can lead to local privilege escalation and carries a CVSS score of 8.7. The vendor released updated versions addressing all six issues in Veeam ONE 13.1. Security researchers and administrators are urged to apply the patches immediately given the high severity and lack of authentication requirements for the critical vulnerability.