“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing

AhnLab reported a sophisticated backdoor named "MoiClient" distributed as a VHDX invoice that sideloads a malicious uxtheme.dll via a legitimate SumatraPDF executable, injects into explorer.exe, escalates privileges using an AppInfo RPC-based UAC bypass, and abuses a vulnerable Lenovo driver (BootRepair.Sys) via BYOVD to disable a wide range of security products. MoiClient achieves persistence through Task Scheduler (reloading every 30 minutes), downloads an additional in-memory payload identified as the MoiXD stealer to exfiltrate browser-stored credentials, and includes IoCs and mitigation steps (process checks, scheduled tasks, and specific file paths) for detection and cleanup.