Discovery Date: March 2025
CVE ID: CVE-2024-11859
Exploit Severity: CVSS 6.8 (Medium, per ESET)
Threat Actor: ToddyCat (linked to advanced espionage operations in Asia and Europe)
Attack Vector: DLL side-loading via ESET Antivirus software
Target Profile: Government agencies, military assets, critical infrastructure (suspected)
The Trojan Inside the Guard Tower
In an ironic twist that cybersecurity professionals dread but attackers dream of, ESET — a company trusted to stop malware — unknowingly enabled it.
Researchers from Russian cybersecurity firm Kaspersky recently revealed that state-linked hacking group ToddyCat exploited a now-patched flaw in ESET’s antivirus scanner to side-load malicious DLLs, essentially turning trusted security software into a stealth infection vector.
The exploit, CVE-2024-11859, allowed attackers to insert a rogue DLL (Dynamic Link Library) into ESET’s scanning process. Once triggered, the malicious file executed payloads in the background — with no alert, no trace, and no elevated permissions needed beyond standard admin access.
ESET’s Confirmation — and Limitations
ESET has confirmed the existence of the vulnerability and issued a patch, stating:
“The flaw did not allow privilege escalation and required pre-existing admin rights to execute.”
Translation: If the attacker was already inside the house, this flaw opened the security vaults.
While ESET rated it as medium severity, the fact that security software itself became the unwitting accomplice marks this as a high-risk, high-impact supply chain weakness.
Despite downplaying real-world impact, ESET’s advisory didn’t refute the overall tactic — nor could it verify the origin of the exploit due to the lack of access to the malicious DLLs used by ToddyCat in the wild.
Meet ToddyCat: A Phantom in the Network
Active since at least 2020, ToddyCat has emerged as a highly evasive threat group with deep expertise in long-term infiltration, data exfiltration, and operating within high-security environments.
Past activity includes:
- Governmental espionage across Taiwan, Vietnam, India, and Europe
- APAC intelligence theft from ministries, military research centers, and telecommunications providers
- Custom tunneling tools for cloud abuse, VPN hijacking, and multi-layer fallback exfiltration
Analysts have not officially attributed ToddyCat to any specific nation, but there are heavy overlaps with known Chinese cyber-espionage tradecraft — including EDRSandBlast, a known malware strain often used in APT campaigns tied to China.
The Payload: Enter TCDSB
During this latest exploitation campaign, attackers deployed a new modular toolset named TCDSB — a heavily disguised malware loader masquerading as a legitimate DLL file.
TCDSB is believed to be a derivative of EDRSandBlast, retooled with:
- Custom payload loaders
- Anti-monitoring features
- OS manipulation routines to disable alerts triggered by process injection or file drops
It didn’t elevate privileges — it didn’t need to.
With the ESET flaw in play, TCDSB ran quietly, efficiently, and invisibly — sidestepping endpoint protection while slipping into system memory without any indication to the end user.
A Refined Attack Chain
This wasn’t just opportunistic malware. It was surgical tradecraft. The ToddyCat intrusion flow, as reconstructed by threat researchers, looked something like this:
- Initial Access — gained via spearphishing, compromised VPN accounts, or lateral movement within partner networks.
- Privilege Consolidation — attackers operated under existing admin-level credentials.
- ESET Exploitation — CVE-2024-11859 leveraged to deploy rogue DLLs via ESET scanner.
- TCDSB Deployment — fake DLLs side-loaded silently, executing malicious payloads.
- Persistence & Data Exfiltration — data siphoned out using tunnels through trusted cloud providers or custom reverse proxies.
- Fallback Systems — multiple data exfiltration mechanisms enabled redundancy if detection or blocking occurred.
The Broader Threat: Supply Chain Exploits in Security Software
What makes this case more alarming is not just that ESET was vulnerable, but that security tools themselves are now on the menu for advanced actors.
This follows a growing pattern:
- 2023: A flaw in Fortinet firmware exploited to breach U.S. water systems
- 2024: Kaseya and Ivanti exploitation for deep lateral compromise
- 2025 (Q1): Microsoft Defender zero-day used to inject PowerShell modules
With ESET added to the list, it’s clear: Trusted tools are now the most valuable real estate in the attacker’s playbook.
Attribution Games and Geopolitical Shadows
ESET declined to attribute the attack directly to ToddyCat, citing lack of evidence. Kaspersky, however, remains confident in the connection based on TTPs (Tactics, Techniques, Procedures) and code similarity with earlier operations.
If accurate, this points again to a broader espionage campaign — one that isn’t just looking to disrupt, but to harvest long-term intelligence from governmental and military systems.
ToddyCat’s past focus on long-dwell espionage, modular malware, and silent tunneling supports this theory.
And with Taiwan, Vietnam, and European assets repeatedly in their crosshairs, the geopolitical context cannot be ignored.
Defenders’ Playbook: What Now?
With this exploit now patched, defenders should take the following steps immediately:
- Update all ESET installations to the latest build — patch CVE-2024-11859 across enterprise and personal systems.
- Audit system DLLs for irregular or recently changed files in ESET directories.
- Harden admin access — since this attack still required privilege-level access, least privilege policies are essential.
- Hunt for TCDSB indicators, especially alongside activity resembling EDRSandBlast.
- Implement anomaly-based detection for antivirus processes performing out-of-band behavior.
Closing Thoughts: The Sword in the Shield
When cybersecurity software is turned against the people it’s meant to protect, the implications are vast. This wasn’t just a flaw — it was a warning:
Even the protectors can become compromised.
ToddyCat’s ability to bend security software into a delivery tool shows just how far the landscape has shifted. The digital war no longer draws lines between attackers and defenders — it blurs them.
🔥 NOW AVAILABLE! 🔥
📖 INK & FIRE: BOOK 1 📖
A bold and unapologetic collection of poetry that ignites the soul. Ink & Fire dives deep into raw emotions, truth, and the human experience—unfiltered and untamed.
🔥 Kindle Edition 👉 https://a.co/d/9EoGKzh
🔥 Paperback 👉 https://a.co/d/9EoGKzh
🔥 Hardcover Edition 👉 https://a.co/d/0ITmDIB
Get your copy today and experience poetry like never before. #InkAndFire #PoetryUnleashed #FuelTheFire
🚨 NOW AVAILABLE! 🚨
📖 THE INEVITABLE: THE DAWN OF A NEW ERA 📖
A powerful, eye-opening read that challenges the status quo and explores the future unfolding before us. Dive into a journey of truth, change, and the forces shaping our world.
🔥 Kindle Edition 👉 https://a.co/d/0FzX6MH
🔥 Paperback 👉 https://a.co/d/2IsxLof
🔥 Hardcover Edition 👉 https://a.co/d/bz01raP
Get your copy today and be part of the new era. #TheInevitable #TruthUnveiled #NewEra
🚀 NOW AVAILABLE! 🚀
📖 THE FORGOTTEN OUTPOST 📖
The Cold War Moon Base They Swore Never Existed
What if the moon landing was just the cover story?
Dive into the boldest investigation The Realist Juggernaut has ever published—featuring declassified files, ghost missions, whistleblower testimony, and black-budget secrets buried in lunar dust.
🔥 Kindle Edition 👉 https://a.co/d/2Mu03Iu
🛸 Paperback Coming Soon
Discover the base they never wanted you to find. TheForgottenOutpost #RealistJuggernaut #MoonBaseTruth #ColdWarSecrets #Declassified
Help us bring real change! Corporate lobbying has corrupted our system for too long, and it’s time to take action. Please sign and share this petition—your support is crucial in restoring accountability to our government. Every signature counts! Thank you!
https://www.ipetitions.com/petition/restore-our-republic-end-lobbying
Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!
https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
