Process Injection (T1055): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1055.
- Tactical Phase: Defense Evasion.
- Substantiated in 4 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (4)
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
"Dridex injected dynamic link library code into running Internet Explorer and Chrome browser processes to intercept HTTPS traffic."
WannaCry Global Self-Propagating Ransomware Worm
Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.
The kernel payload injected the WannaCry launcher into lsass.exe, initiating worm replication threads and payload unpacking.
Operation Duck Hunt (QakBot Botnet Infrastructure Takedown)
Historic international law enforcement operation led by the FBI that dismantled the notorious QakBot (QBot) modular banking trojan and botnet infrastructure infecting over 700,000 computers worldwide, seizing 52 servers and executing a court-authorized payload to uninstall the malware from victim endpoints.
"The core loader injected malicious shellcode into legitimate processes such as explorer.exe and wermgr.exe to evade host-based anti-virus detection."
U.S. v. Mark Vartanyan (Citadel Banking Trojan Distribution)
Russian crimeware developer known as 'Kolypto' extradited from Norway and sentenced to five years in federal prison for developing, updating, and supporting Citadel, an advanced Zeus-based banking trojan that infected over 11 million computers worldwide and inflicted over $500 million in commercial financial losses.
"Injected malicious dynamic link libraries into running explorer.exe and svchost.exe processes to hide persistence and bypass personal firewall controls."
Commonly Charged Criminal Statutes
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.