Loading malware…
KrustyLoader is a Rust-based initial-stage malware family used to retrieve and launch follow-on payloads, most notably the Sliver command-and-control implant. It has been observed in both Linux and Windows variants. On Linux, samples associated with exploitation of edge and enterprise applications perform execution-environment checks, decrypt an embedded staging URL, download an encrypted second-stage payload, write it to a temporary location, make it executable, execute it, and delete themselves from disk. On Windows, observed samples retrieve an encrypted Sliver payload from cloud storage, decrypt it in memory, inject it into a legitimate process, and remove the loader from disk to reduce forensic visibility.
KrustyLoader is closely associated with China-nexus intrusion activity, especially clusters tracked as UNC5221, UTA0178, and QuietCrabs. It has been used after exploitation of internet-facing systems including Ivanti Connect Secure, Ivanti Endpoint Manager Mobile, SAP NetWeaver, and Microsoft SharePoint, typically following deployment of web shells or other post-compromise tooling. Reporting also places it alongside broader Chinese espionage tradecraft involving long-term access, credential theft, reconnaissance, and lateral movement through the delivered Sliver implant and related utilities.
The malware uses layered obfuscation and encrypted configuration material, including staged URL decryption and encrypted payload retrieval. Documented Linux samples include anti-analysis and execution-guard logic, such as self-path checks, parent-process validation, and anti-debugging behavior. Across observed campaigns, KrustyLoader’s primary role is as a downloader or loader that enables covert post-exploitation access rather than acting as the final persistence or espionage platform itself. Victimology has included government, telecommunications, healthcare, finance, universities, and other organizations operating exposed edge or enterprise infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: SAP NetWeaver (CVE-2025-31324) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: Ivanti Endpoint Manager Mobile (CVE-2025-4428) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708) | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
Vendors additionally document KrustyLoader delivery through exploitation of specific internet-facing vulnerabilities, including the following: JetBrains TeamCity (CVE-2023-42793). | KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
On July 25, KrustyLoader was dropped by the attackers. KrustyLoader was first documented in January 2024. It is an initial-stage malware, written in Rust, which has the primary purpose of delivering a second-stage payload.
On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These vulnerabilities can be chained to achieve unauthenticated remote code execution (RCE) on exposed systems. | “EclecticIQ analysts observed the execution of KrustyLoader malware within compromised Ivanti EPMM systems… Once installed, KrustyLoader retrieves a second-stage payload — an AES-128-CFB encrypted version of the Sliver backdoor.”
UNC5221 was seen abusing a webshell to execute remote commands and fetch from an AWS S3 infrastructure the Rust-based malware loader KrustyLoader, which is typically used for dropping Sliver backdoors.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
KrustyLoader is a downloader that retrieves an encrypted Sliver payload from a second S3 location, injects it into Windows Explorer, and erases itself from disk, leaving the cyber threat actors (CTAs) with immediate covert access to victims’ systems.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
open-source reporting from Volexity and EclecticIQ indicates threat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromised host
It makes the random file executable using system command chmod +x /tmp/randomfile .
“Threat actors use HTTP GET requests, containing Java-based commands… designed to execute external malicious processes… spawning a reverse shell… using /bin/bash”
As a general point, there is a bit of obfuscation: most symbols are XOR-encrypted stack strings. The process of decryption used by the malware to retrieve the URL has three steps... XOR each byte with a 1-byte key; And uses AES-128 CFB-1 mode with hardcoded key and initialization vector to decrypt and get the URL.
KrustyLoader decrypts the payload in memory, injects it into a live explorer.exe process using a dynamically resolved thread-creation function ( RtlCreateUserThread )
KrustyLoader... can make a copy of itself and set itself up to self-delete when its activity is finished...
injects it into Windows Explorer, and erases itself from disk... accessing the URL in a containerized environment produced an automatic file download followed by an immediate self-deletion attempt
“embedded URL… hex string, then XOR encrypted (key: 0x49), and finally encrypted using AES-128 in CFB mode… decrypts… and injects it directly into memory”
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based downloader/loader delivered from compromised or attacker-controlled AWS S3 buckets. It decrypts an embedded configuration, retrieves an encrypted second-stage payload, decrypts it in memory, injects it into explorer.exe using RtlCreateUserThread, and self-deletes to reduce forensic artifacts. The campaign is associated in open-source reporting with credential theft and long-term access after exploitation of internet-facing systems.
KrustyLoader is a loader malware used to download and execute additional payloads, such as the Sliver implant, after initial access.
Backdoor/loader deployed against edge networking devices by the QuietCrabs cluster.
KrustyLoader is a loader malware associated with the QuietCrabs threat actor, used to deploy additional payloads and facilitate further compromise. It has been observed in both Linux and Windows environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.