Loading threat actor…
CountLoader is a financially motivated cybercriminal threat actor associated with malware campaigns targeting cryptocurrency users. The actor has been linked to loader and malware-delivery activity used to deploy cryptocurrency-focused theft tooling, including a fake browser extension that performs clipboard wallet-address substitution to redirect digital-asset transfers. CountLoader activity has also been associated with abuse of Chromium trust mechanisms to install malicious extensions without normal user approval and with the use of EtherHiding to retrieve command-and-control information from blockchain-based resources, complicating detection and takedown. CountLoader has used socially engineered lures, including themes designed to attract security researchers, and has targeted a broad cryptocurrency ecosystem. Reported targeting includes numerous cryptocurrency wallet browser extensions, many Chromium-based browsers, and hardware-wallet management software. Observed persistence and propagation behaviors include scheduled-task persistence and USB-spread via shortcut-based execution chains invoking HTML application content. Infrastructure analysis links CountLoader to hosting overlap with other criminal malware operations, including shared network space associated with QuasarRAT activity attributed to WaterHydra/DarkCasino. CountLoader has been observed using command-and-control infrastructure in the same hosting block as other malware campaigns, suggesting ecosystem overlap or shared service providers rather than an isolated operation. Known aliases are limited to CountLoader.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
15 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with a malicious campaign distributing a fake Google Notes browser extension that steals cryptocurrency by replacing copied wallet addresses with attacker-controlled ones and uses EtherHiding to retrieve command-and-control infrastructure from the blockchain.
Malware operation using fake CCleaner-themed infrastructure and HTA payloads to target cryptocurrency wallets and lure security researchers, with infrastructure colocated in the same /24 as evilgrou-tech Sentinel C2.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.