Threats Tagged 'loader'

China-nexus threat actors have deployed a highly opportunistic automated spray-and-check campaign to compromise global government and commercial infrastructure across more than 100 countries. The operation utilizes centralized multi-platform attack infrastructure featuring cracked Cobalt-Strike derivatives and a sophisticated loader ecosystem. Attackers leverage primary infrastructure at 130.94.17.180 for scanning, exploitation, command-and-control, and payload hosting. The campaign employs stage-2 and stage-3 payloads delivered through architecture-specific loaders targeting both Linux and Windows systems. Transport variants include TCP, WebSocket, and KCP protocols. The SNOWLIGHT loader panel manages payload delivery through multiple endpoints. Organizations face persistent threats requiring immediate patching of exposed services, implementation of strong multi-factor authentication, and continuous monitoring for compromise indicators.

A newly discovered loader called SILENTCONNECT is being used in active campaigns to silently install ScreenConnect, a remote monitoring and management tool, on victim machines. The infection chain begins with users being redirected to a Cloudflare Turnstile CAPTCHA page disguised as a digital invitation. Upon clicking, a VBScript file is downloaded, which retrieves and executes C# source code in memory using PowerShell. SILENTCONNECT employs various evasion techniques, including PEB masquerading and UAC bypass. The campaigns leverage trusted hosting providers like Google Drive and Cloudflare, and abuse living-off-the-land binaries. The loader has been active since March 2025 and poses a significant threat due to its stealthy nature and effectiveness.

MediumMalwareUnited StatesUnited KingdomAustralia+9#silentconnect#phishing#rmm

A widespread campaign is distributing the RenEngine loader malware disguised as pirated games and software. The loader uses a modified Ren'Py game engine to deliver payloads like Lumma and ACR stealers. It employs sophisticated techniques including sandbox evasion, process injection, and modular design. The infection chain involves decrypting and launching malicious code through legitimate applications. RenEngine has affected users globally, with Russia, Brazil, Turkey, Spain and Germany most impacted. The campaign highlights risks of pirated software and the need for robust security measures.

MediumCampaignGermanySpainRussia+2#loader#lumma#vidar

A multi-domain traffic distribution system (TDS) operation was discovered, centered around the domain toxicsnake-wifes.com. The infrastructure serves as a commodity cybercrime TDS farm, routing victims to phishing, scams, or malware payloads. The operation uses a first-stage JavaScript loader, followed by a second-stage that attempts to fetch upstream payloads. The cluster shares common WHOIS, DNS, and hosting patterns, indicative of bulletproof VPS usage. Multiple burner domains with similar tradecraft were identified, suggesting an organized operator cluster. The infrastructure employs obfuscation, dynamic remote injection, and disposable registration techniques. While the main payload was unreachable during analysis, historical evidence suggests the delivery of malicious content.

MediumCampaignGermanyFranceUnited Kingdom+5#cybercrime#obfuscation#javascript

CastleLoader is a sophisticated malware loader designed to deliver and install malicious components, primarily targeting government entities and critical infrastructure. It employs a multi-stage execution chain involving Inno Setup, AutoIt, and process hollowing to evade detection. The loader delivers information stealers and RATs, enabling credential theft and persistent access. The analysis reveals its stealthy nature, relying on memory-only payloads and API resolution via hashing. The malware's configuration, including C2 infrastructure, was extracted through reverse engineering, providing high-confidence indicators of compromise for detection and analysis.

MediumMalwareGermanyFranceUnited Kingdom+3#castleloader#memory-only#loader

Turla's Kazuar v3 loader employs sophisticated techniques to evade detection. It uses a VBScript to drop files and execute a native loader, which bypasses security measures and leverages COM for stealth. The loader utilizes control flow redirection, patchless ETW and AMSI bypasses, and COM integration to decrypt and execute three Kazuar v3 payloads (KERNEL, WORKER, BRIDGE) in memory. The attack chain is designed to be resilient and stealthy, exploiting trusted system processes to avoid detection. The malware uses modular architecture and COM subsystem integration to maintain a low profile while carrying out its malicious activities.

MediumMalwareUkraineGermanyFrance+3#kazuar#loader#amsi bypass

The October 2025 Infostealer Trend Report highlights the ongoing and evolving threat posed by Infostealer malware families such as Rhadamanthys, ACRStealer, and LummaC2. Attackers have shifted distribution tactics, increasingly leveraging legitimate websites to evade detection and search engine restrictions, a technique known as SEO poisoning. A notable development is the mass distribution of a new Loader malware employing DLL sideloading to execute malicious payloads stealthily. The report also details changes in LummaC2 distribution patterns and the use of sophisticated disguise and phishing techniques to target companies. These Infostealers aim to exfiltrate sensitive information, posing risks to confidentiality and potentially enabling further attacks. The threat does not require known exploits or zero-day vulnerabilities but relies on social engineering and advanced evasion methods. European organizations are at risk due to the widespread use of affected malware and the targeting of companies via phishing. Mitigation requires proactive detection of DLL sideloading, monitoring for SEO poisoning campaigns, and enhanced phishing defenses.

MediumCampaignGermanyFranceNetherlands+3#seo poisoning#rhadamanthys#acrstealer

A new malware loader discovered in May 2025 executes two malware families: TorNet and PureHVNC. The loader uses API hashing with MurmurHash2 and implements persistence through registry modifications. It decrypts and decompresses payloads using AES-128-ECB and LZMA, then injects them into a suspended jsc.exe process. TorNet, a downloader malware, communicates via TOR network, while PureHVNC is a commercial RAT allowing remote access. Both malware use Protocol Buffers for configuration deserialization. The loader's unique characteristics include its dual payload execution and API hashing implementation, indicating potential future attack techniques.

MediumMalwareGermanyFranceUnited Kingdom+4#purehvnc#loader#murmurhash2

SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers. Once opened, the malware automatically propagates via WhatsApp Web, causing infected accounts to be banned due to excessive spam activity.

MediumMalwareBrazilUnited KingdomGermany+4#malware#phishing#whatsapp

Olymp Loader is a recently emerged Malware-as-a-Service offering advertised on underground forums since June 2025. Developed by a team called OLYMPO, it's written in assembly language and marketed as fully undetectable. The loader executes other malware on victim systems and provides built-in stealer modules for browsers, Telegram, and crypto wallets. It enables rapid feature updates and fast adoption by cybercriminals. The malware has evolved from an initial botnet concept to focus on loader and crypter functionalities. Distribution methods include disguising as legitimate software and using other malware like Amadey as initial access. Post-infection payloads primarily include credential stealers and remote access tools.

MediumMalwareGermanyFranceUnited Kingdom+5#qasarrat#stealer#malware-as-a-service