MalwarePublished 21 Jul 2025Updated 20 Aug 2025

New Wave of SquidLoader Malware Targeting Financial Institutions

Source AlienVault OTX General

Description

A sophisticated malware campaign is targeting financial services in Hong Kong with SquidLoader, a highly evasive malware that deploys Cobalt Strike Beacon for remote access. The malware exhibits advanced anti-analysis, anti-sandbox, and anti-debugging techniques, achieving near-zero detection rates on VirusTotal. The attack chain is complex and poses a significant threat to targeted organizations. The analysis provides detailed technical insights into SquidLoader's features and indicators of compromise, including SHA256 hashes for samples found in Hong Kong, Singapore, China, and Australia. The campaign utilizes multiple command and control servers, primarily mimicking Kubernetes API endpoints.

Impact

For European organizations, particularly those in the financial sector, the emergence of SquidLoader poses a substantial risk. The malware’s ability to evade detection and establish persistent remote access could lead to unauthorized data exfiltration, disruption of financial operations, and potential financial losses. The use of Cobalt Strike Beacon facilitates lateral movement and privilege escalation within compromised networks, increasing the risk of widespread compromise. The mimicry of Kubernetes API endpoints as part of the C2 infrastructure is particularly concerning for organizations adopting cloud-native technologies and container orchestration platforms, as it may allow attackers to blend in with legitimate traffic and evade traditional security controls. Given the financial sector’s critical role in the European economy and the increasing adoption of Kubernetes and cloud infrastructure, this threat could disrupt services, damage reputations, and result in regulatory penalties under frameworks such as GDPR if sensitive customer data is compromised. Additionally, the campaign’s presence in Asia-Pacific regions suggests potential targeting of European financial institutions with business ties or operations in those areas, increasing the likelihood of cross-regional impact.

Defensive guidance

European financial institutions should implement targeted detection and response strategies to mitigate the SquidLoader threat. Specific recommendations include: 1) Deploy advanced endpoint detection and response (EDR) solutions capable of identifying Cobalt Strike Beacon behaviors and process injection techniques; 2) Monitor network traffic for anomalies, especially traffic mimicking Kubernetes API calls, and implement strict network segmentation to limit lateral movement; 3) Harden Kubernetes and container orchestration environments by enforcing strong authentication, role-based access control (RBAC), and regular audit logging to detect unauthorized access attempts; 4) Utilize threat intelligence feeds to update detection rules with the provided IP addresses, URLs, and file hashes associated with SquidLoader; 5) Conduct regular threat hunting exercises focusing on anti-analysis and anti-debugging indicators that may reveal stealthy malware presence; 6) Implement strict application whitelisting and file integrity monitoring to detect unauthorized file modifications or executions; 7) Educate security teams on the latest tactics, techniques, and procedures (TTPs) used by SquidLoader to improve incident response readiness; 8) Collaborate with industry information sharing groups to stay informed about emerging variants and attack patterns; 9) Ensure timely patching of all systems, especially those related to cloud and container infrastructure, to reduce attack surface; 10) Employ multi-factor authentication (MFA) and least privilege principles to reduce the risk of credential compromise and misuse.

Indicators of compromise

URLs 6

http://121.41.14.96/api/v1/namespaces/kube-system/services
http://38.55.194.34/api/v1/namespaces/kube-system/services
http://39.107.156.136/api/v1/namespaces/kube-system/services
http://47.116.178.227/api/v1/namespaces/kube-system/services
http://47.116.178.227:443/api/v1/namespaces/kube-system/services
http://8.140.62.166/api/v1/namespaces/kube-system/services

IP addresses 5

121.41.14.96
38.55.194.34
8.140.62.166
39.107.156.136
47.116.178.227

Hashes 7

2d371709a613ff8ec43f26270a29f14a0cb7191c84f67d49c81d0e044344cf6c
34d602d9674f26fa2a141c688f305da0eea2979969f42379265ee18589751493
6960c76b624b2ed9fc21546af98e1fa2169cd350f37f6ca85684127e9e74d89c
9dae4e219880f0e4de5bcba649fd0741e409c8a56b4f5bef059cdf3903b78ac2
a244bfcd82d4bc2de30fc1d58750875b638d8632adb11fe491de6289ff30d8e5
b2811b3074eff16ec74afbeb675c85a9ec1f0befdbef8d541ac45640cacc0900
bb0f370e11302ca2d7f01d64f0f45fbce4bac6fd5613d8d48df29a83d382d232

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jul 2025, 13:01 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

URLs 6

IP addresses 5

Hashes 7

Community reviews

Related threats