Loading malware…
KrustyLoader is a Rust-based malware loader with Linux and Windows variants, primarily used to download, decrypt, and execute Sliver implants. First publicly documented in January 2024 during compromises of Ivanti Connect Secure VPN appliances, it serves as an initial-stage payload deployed after attackers gain access to internet-facing systems. Its use is associated with the China-nexus espionage cluster tracked as UNC5221, UTA0178, and QuietCrabs, although not every observed deployment has been conclusively attributed.
KrustyLoader obscures its embedded staging URL through hexadecimal encoding, XOR transformation, and AES-128-CFB encryption. It retrieves an encrypted second-stage payload, frequently from Amazon S3 storage, and decrypts it using embedded cryptographic material. Analyzed Linux variants write the decrypted payload to a randomly named temporary file, grant execution permissions, and launch it. Windows variants decrypt the payload in memory and inject it into Windows Explorer. Evasion features include debugger detection, execution-directory and prerequisite-file checks, string obfuscation, and self-deletion. Some Windows variants additionally employ control-flow flattening and relocated, self-deleting executable copies.
Deployment has followed exploitation of Ivanti Connect Secure vulnerabilities CVE-2023-46805 and CVE-2024-21887, Ivanti Endpoint Manager Mobile vulnerabilities CVE-2025-4427 and CVE-2025-4428, and vulnerabilities in ConnectWise ScreenConnect, SAP NetWeaver, and Microsoft SharePoint. Attackers also use web shells and scripts to retrieve and launch the loader. Affected systems include Linux-based edge appliances and Windows enterprise servers. KrustyLoader delivers the Sliver implant rather than independently providing Sliver's interactive remote-control, file-transfer, and lateral-movement capabilities.
11 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
They share almost 100% code similarity and their main purpose is to download and execute a Sliver backdoor. I personally labelled this piece of malware as KrustyLoader.
KrustyLoader is a loader written in Rust. Its primary function is to decrypt a URL pointing to the payload, download that payload, inject it into a target process, and run it.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
APT41 (tracked as UNC5221) has been attributed to exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) software (CVE-2025-4427 and CVE-2025-4428).
It makes the random file executable using system command chmod +x /tmp/randomfile .
“Threat actors use HTTP GET requests, containing Java-based commands… designed to execute external malicious processes… spawning a reverse shell… using /bin/bash”
The malware reads /proc/self/exe to gets its path ( readlink ) and deletes itself ( unlink )... It gets the process parent ID (PPID) using getppid syscall
Finally, it tries to execute the newly created executable and exits.
KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function ( RtlCreateUserThread )
Ivanti disclosed two zero-day critical vulnerabilities affecting Connect Secure VPN product: CVE-2024-21887 and CVE-2023-46805 allowing unauthenticated remote code execution.
As a general point, there is a bit of obfuscation: most symbols are XOR-encrypted stack strings. The process of decryption used by the malware to retrieve the URL has three steps... XOR each byte with a 1-byte key; And uses AES-128 CFB-1 mode with hardcoded key and initialization vector to decrypt and get the URL.
KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function ( RtlCreateUserThread )
KrustyLoader... can make a copy of itself and set itself up to self-delete when its activity is finished...
injects it into Windows Explorer, and erases itself from disk... accessing the URL in a containerized environment produced an automatic file download followed by an immediate self-deletion attempt
“embedded URL… hex string, then XOR encrypted (key: 0x49), and finally encrypted using AES-128 in CFB mode… decrypts… and injects it directly into memory”
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
Anti-debug checks: it reads /proc/self/exe again (now the value suffixed with " (deleted)" ) and exits if it contains gdb or lldb (both debuggers) strings.
used that access to write and execute the loader on the compromised host for credential theft and long-term access
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
Anti-debug checks: it reads /proc/self/exe again (now the value suffixed with " (deleted)" ) and exits if it contains gdb or lldb (both debuggers) strings.
“forming a reliable command-and-control (C2) mechanism using server-side Java injection” and repeated use of HTTP GET/curl/wget to retrieve payloads
KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location
51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.