Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1129: Shared Modules

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.[1][2][3][4]

The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows Native API which is called from functions like `LoadLibrary` at run time.[5]

EnterpriseT1129TechniqueObject v2.3 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Shared Modules matters because normal operating-system functionality for loading reusable code can also be used to run malicious payloads inside legitimate processes. For leaders, the practical risk is that malware can appear as a modular plugin, DLL, .so, or .dylib rather than a standalone executable, making execution control and investigation harder across Windows, Linux, and macOS estates.

Executive priority

Prioritize this technique where business-critical servers, identity infrastructure, POS or hospitality systems, Linux server fleets, macOS endpoints, or industrially relevant Windows environments depend on high-trust processes. ATT&CK relationships show use across many malware families and contexts, including backdoors, RATs, spyware, loaders, credential theft, AD FS compromise, POS targeting, and ICS-related malware. The executive question is whether application control, module-load visibility, and incident response playbooks can prove what code is allowed to run inside important processes.

Technical view

T1129 is an execution technique. On Linux and macOS, defenders should validate visibility into shared object and dynamic library loading from local paths, including .so and .dylib usage through loader functions such as dlopen and dlsym. On Windows, validate DLL loading from local paths and UNC network paths through loader behavior such as LoadLibrary and Native API activity. Because MITRE provides no official detection text, use the related DET0018 behavior-chain, platform-aware detection strategy as supporting context and build detections around unusual module load paths, unexpected parent processes, modular plugin behavior, and modules associated with sensitive services.

Likely telemetry

  • Process creation and process lineage for applications that load modules
  • Module or library load events for DLL, .so, and .dylib files
  • File creation, modification, and execution metadata for shared modules on local paths
  • Windows evidence of DLL loads from local and UNC paths
  • Linux/macOS dynamic loader activity and filesystem paths for shared objects or dynamic libraries

Detection direction

  • Confirm whether module-load telemetry is collected on Windows, Linux, and macOS; process-only logging is often insufficient for this technique.
  • Baseline legitimate shared module behavior for critical applications so detections do not trigger on normal plugin and update mechanisms.
  • Tune for modules loaded from unexpected local paths, network paths, or locations not normally used by the parent application.
  • Correlate module loads with surrounding behavior such as new file writes, process starts, privilege context, network communications, or sensitive service access.
  • Give special review to high-value services and identity-related systems because related software includes FoggyWeb, described as targeting compromised AD FS servers.

Mitigation priorities

  • Start with execution prevention for unauthorized or malicious code, consistent with ATT&CK mitigation M1038.
  • Define which modules, libraries, and plugins are trusted for critical applications and enforce that policy where feasible.
  • Restrict loading from untrusted local directories and network paths, especially for high-value Windows services and administrative systems.
  • Harden file permissions around application directories and shared library locations so unauthorized users cannot place or replace modules.
  • Include shared-module abuse in IR triage: collect loaded-module lists, module paths, hashes, timestamps, and parent process context before remediation.
Analyst notes and limits

The relationship set is broad: Mustang Panda is listed as using the technique, and many software entries are related, including gh0st RAT, PUNCHBUGGY, Hydraq, OSX_OCEANLOTUS.D, Astaroth, Ebury, BOOSTWRITE, Attor, Metamorfo, TajMahal, PipeMon, BLINDINGCAN, Dtrack, Stuxnet, KillDisk, FoggyWeb, DarkWatchman, Bumblebee, RotaJakiro, VersaMem, and LightSpy. This supports treating Shared Modules as a common execution pattern rather than a niche malware feature.

MITRE does not provide official detection guidance for this object, so detection recommendations require local telemetry validation and tuning. The ATT&CK object supports Linux, macOS, and Windows; relationship entries may mention other software platforms, but platform coverage should be assessed against the local environment and available sensors. This summary does not assert current exploitation or customer exposure.

Official MITRE ATT&CK definition

Shared Modules

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.

The Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.[1][2][3][4]

The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows Native API which is called from functions like `LoadLibrary` at run time.[5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Malware Enterprise

S0603: Stuxnet

Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]

Windows
Malware Enterprise

S0373: Astaroth

Astaroth is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. [1][2][3]

Windows
Malware Enterprise

S1185: LightSpy

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.[1]

AndroidWindowsiOS
Malware Enterprise

S0607: KillDisk

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.[1][2][3][4]

LinuxWindows
Malware Enterprise

S0455: Metamorfo

Metamorfo is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.[1][2]

Windows
Malware Enterprise

S0438: Attor

Attor is a Windows-based espionage platform that has been seen in use since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets.[1]

Windows
Malware Enterprise

S0661: FoggyWeb

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.[1]

Windows
Malware Enterprise

S1078: RotaJakiro

RotaJakiro is a 64-bit Linux backdoor used by APT32. First seen in 2018, it uses a plugin architecture to extend capabilities. RotaJakiro can determine it's permission level and execute according to access type (`root` or `user`).[1][2]

Linux
Relationship explorer

All related ATT&CK context

uses · Malware S0032: gh0st RAT Enterprise uses · Malware S0203: Hydraq Enterprise uses · Malware S0196: PUNCHBUGGY Enterprise detects · Detection Strategy DET0018: Behavior-chain, platform-aware detection strategy for T1129 Shared Modules Enterprise uses · Malware S0603: Stuxnet Enterprise mitigates · Mitigation M1038: Execution Prevention Enterprise uses · Malware S0373: Astaroth Enterprise uses · Malware S1185: LightSpy Enterprise uses · Malware S0607: KillDisk Enterprise uses · Malware S0455: Metamorfo Enterprise uses · Group G0129: Mustang Panda Enterprise uses · Malware S0673: DarkWatchman Enterprise uses · Malware S0438: Attor Enterprise uses · Malware S0661: FoggyWeb Enterprise uses · Malware S1078: RotaJakiro Enterprise uses · Malware S0520: BLINDINGCAN Enterprise uses · Malware S1039: Bumblebee Enterprise uses · Malware S0467: TajMahal Enterprise uses · Malware S0377: Ebury Enterprise uses · Malware S0415: BOOSTWRITE Enterprise uses · Malware S0567: Dtrack Enterprise uses · Malware S0352: OSX_OCEANLOTUS.D Enterprise uses · Malware S0501: PipeMon Enterprise uses · Malware S1154: VersaMem Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
6b04451806638be1...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.3 Current bundle 6b0445180663…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Apple Dev Dynamic Libraries

    Apple. (2012, July 23). Overview of Dynamic Libraries. Retrieved September 7, 2023.

    Open source URL
  2. [2]
    Linux Shared Libraries

    Wheeler, D. (2003, April 11). Shared Libraries. Retrieved September 7, 2023.

    Open source URL
  3. [3]
    RotaJakiro 2021 netlab360 analysis

    Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.

    Open source URL
  4. [4]
    Unit42 OceanLotus 2017

    Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.

    Open source URL
  5. [5]
    Microsoft DLL

    Microsoft. (2023, April 28). What is a DLL. Retrieved September 7, 2023.

    Open source URL
  6. [6]
    mitre-attack T1129
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use