DodgeBox | ThreatLabz

Zscaler ThreatLabz details the discovery and technical analysis of DodgeBox, a sophisticated reflective DLL loader used to deploy the MoonWalk backdoor; the report describes the attack chain (signed EXE DLL sideloading -> DodgeBox -> encrypted DAT -> MoonWalk using Google Drive C2), multiple advanced evasion techniques (stack spoofing, DLL hollowing/sideloading, CFG disabling, environment keying), telemetry linking samples to Southeast Asia, IOC listings, and attribution to APT41 with moderate confidence.