BelialDemon

BelialDemon is a financially motivated malware developer and underground-market seller associated with Matanbuchus and TriumphLoader. Matanbuchus is a C++ malware loader marketed as Malware-as-a-Service on Russian-speaking cybercrime forums since February 2021. Its commercial distribution does not establish the developer's nationality or operating location. Matanbuchus downloads and executes additional payloads, supports arbitrary PowerShell execution, and establishes persistence. Delivery campaigns have used phishing attachments, HTML smuggling, and malicious Windows Installer packages masquerading as legitimate software. These installers can display false installation errors while executing malware through trusted Windows utilities. Later campaigns have used ClickFix social engineering and Microsoft Teams helpdesk impersonation with Quick Assist abuse. Matanbuchus 3.0, advertised in July 2025 as a rewritten platform, supports multiple executable and script formats, encrypted command-and-control, security-product discovery, scheduled-task persistence, and layered DLL sideloading. Its defense-evasion techniques include anti-debugging and sandbox checks, encrypted strings and shellcode, API hashing, and Heaven's Gate transitions intended to bypass WoW64 user-mode hooks. Matanbuchus has delivered Cobalt Strike, QakBot, DanaBot, Rhadamanthys, NetSupport RAT, and AstarionRAT. Downstream operators using the platform have conducted lateral movement, created unauthorized domain accounts, and modified Microsoft Defender exclusions. Such customer activity does not establish that BelialDemon personally conducted those intrusions. No specific victim geography or industry focus is established.