CountLoader: New Malware Loader Being Served in 3 Different Versions

A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.

• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• SMB protection from cyberattacks: weak spots and how to fix themAnalysis2026-10-19
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257ExploitedVulnerability2026-10-20
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21