DLL side-loading is a tricky attack method. It's tough for antivirus scans to catch because the running programs seem fine, but the files they call to start running are the actual problem.
Visit https://darknetdiaries.com/episode/103/ for a list of sources, full transcripts, and to listen to all episodes.
...
https://www.youtube.com/watch?v=Wnx_gg_rYhc