Fellowsfellows@cyberplace.social
Apr 10, 2026, 5:56 PM@wdormann if the malicious PDF were blown up in a sandbox, would its activity be detected as abnormal?
Replies
Will Dormannwdormann@infosec.exchangeApr 10, 2026, 5:59 PM@fellows
Depends on the sandbox, I suppose.
The vulnerability being exploited merely reads files likentdll.dllto get version infromation. But the subsequent polling of a remote C2 host is a touch out of the ordinary. At least to me.