NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads entirely in memory, connecting to attacker-controlled servers mainly in Hong Kong. The operation appears focused on Chinese-speaking environments and shows signs of long-term planning by a capable threat group. The infection chain involves multiple stages, including initial NSIS installers, first-stage loaders, and second-stage payloads, ultimately delivering the Winos v4.0 stager. The campaign has evolved over time, adapting its tactics to avoid detection while maintaining core infrastructure and execution logic.

• OpenSUpdater Hides in Recompiled 7zip SFX, Evading AnalystsMalware2026-09-24
• Contagious Interview steps outside the developer workflowMalware2026-09-03
• Counterfeit installers to system compromise: Tracking a deceptive software download campaignCampaign2026-09-02
• The Patch Wars have begunMalware2026-07-16
• Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaignMalware2026-07-16