Vulnerabilities in Foxit & Apryse and the Rise of PDFSider Malware

The PDF ecosystem — long considered a safe productivity layer — is now a prime target for cyberattacks. Recent research from penetration testing startup Novee and threat intelligence firm Resecurity highlights two critical fronts: vendor-side vulnerabilities in popular PDF platforms and malware weaponization through advanced backdoors like PDFSider.

Vendor Vulnerabilities: Foxit & Apryse

• Discovery: Novee uncovered 16 security flaws across Apryse WebViewer and Foxit PDF cloud services.
• Severity Breakdown:
  • Apryse: 1 critical, 2 high-severity.
  • Foxit: 2 high-severity, 11 medium-severity.
• Attack Vectors: DOM XSS, SSRF, stored/reflected XSS, path traversal, OS command injection.
• Exploitation Potential:
  • Account takeover via embedded PDF viewers in authenticated apps.
  • Data exfiltration and manipulation of sensitive documents.
  • Persistent compromise through payloads surviving page refreshes.
• Vendor Response: Both Foxit and Apryse patched promptly, emphasizing responsible disclosure and transparent remediation.

Malware Spotlight: PDFSider

• Threat Actor Tool: PDFSider, a newly identified malware family.
• Capabilities:
  • Encrypted command-and-control (C2) using Botan cryptographic library.
  • Hidden interactive shell for remote code execution (RCE).
  • AV/EDR evasion and DLL sideloading for stealth.
• Delivery Method:
  • Sideloaded via PDF24 Creator (legitimate app).
  • Distributed in spear-phishing ZIP archives.
• Targets:
  • Fortune 100 corporation (via QuickAssist + social engineering).
  • Multiple ransomware groups leveraging it for payload delivery.

DLL Sideloading Trend in Cybercrime

• APT Mustang Panda:
  • Used DLL sideloading in campaigns tied to US-Venezuela conflict.
  • Delivered LotusElite backdoor via spear-phishing ZIPs.
• Commodity Malware Campaigns:
  • Abused Ahost.exe (C-ares library).
  • Delivered AgentTesla, FormBook, Lumma Stealer, Vidar, CryptBot, Remcos, QuasarRAT, DCRat, XWorm.
  • Localized filenames in multiple languages to broaden reach.