Loading threat actor…
ZLoader is a financially motivated eCrime malware operation centered on a banking trojan and malware delivery platform derived from the leaked ZeuS codebase and active since at least 2019. It is commonly tracked as ZLoader and has been associated with broader crimeware ecosystems that overlap with other major malware and ransomware operations. ZLoader has been used for initial compromise and as a post-compromise enabler for follow-on intrusion activity. Documented delivery methods include malicious email attachments using Excel 4.0 macros and malicious MSIX application packages distributed through malvertising and SEO poisoning. In macro-based intrusions, the malware has used anti-analysis checks, downloaded a DLL payload, and executed it through native Windows utilities. In MSIX-based campaigns, ZLoader-related activity has used Advanced Installer packaging and the legitimate AiStub execution chain to launch compiled Python payloads. Operationally, ZLoader has supported broader hands-on-keyboard intrusions that included reconnaissance, persistence, lateral movement, and eventual ransomware deployment. In one documented intrusion chain, a ZLoader infection was followed by use of a custom PowerShell RAT and Cobalt Strike, months of internal reconnaissance and movement, data exfiltration, and eventual DarkSide ransomware deployment. Reporting also links Maze affiliate activity to overlapping crimeware relationships involving ZLoader, Gozi, and TrickBot, indicating that ZLoader has circulated within interconnected financially motivated intrusion ecosystems. ZLoader has also appeared in certificate-abuse investigations in which the same code-signing identities were reused across multiple malware families, including IcedID and other crimeware. This pattern suggests shared access to signing services or intermediaries rather than isolated single-family operations. Known aliases in the supplied material include zloader_(storm_0569).
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Using MSIX packages built with Advanced Installer and the legitimate AiStub.exe binary to launch malicious payloads, with tradecraft consistent with BatLoader-style delivery.
Referenced as an overlapping eCrime malware/group connection associated with the profiled Maze affiliate.
Referenced as part of the affiliate's overlap with other major eCrime malware ecosystems connected to systematic corporate breaches.
Mentioned as another malware operation/family whose binaries were signed with the same abused Authenticode certificates used by SolarMarker, illustrating certificate collisions.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.