LockBit Operators Using Stealthy DLL Sideloading Technique to Load Malicious App as Legitimate One

LockBit ransomware campaigns are increasingly using DLL sideloading to load malicious libraries through legitimate, signed applications (notably jarsigner.exe/jli.dll and MpCmdRun.exe/mpclient.dll), achieve persistence after initial access via remote management tools like MeshAgent and TeamViewer, and encrypt files with a hybrid RSA/AES scheme appending the .xlockxlock extension, enabling sophisticated evasion of reputation- and signature-based defenses.