Loading malware…
LeslieLoader is a Go-based malware loader used by the China-linked espionage group RedNovember, also referred to in reporting as TAG100 and overlapping with Storm-2077. Reporting states that RedNovember uses LeslieLoader to download and deploy SparkRAT, and some reporting further notes a LeslieLoader variant used to deploy both SparkRAT and Cobalt Strike Beacons. Insikt Group identified two LeslieLoader samples used by RedNovember to load SparkRAT. The associated Go-based tooling is reported as supporting Windows, Linux, and macOS, with related post-compromise capabilities in the deployed tooling including file transfer, system fingerprinting, and direct command-line interaction. LeslieLoader appears in campaigns targeting government and private-sector organizations across the U.S., Panama, Asia, and Europe, including defense, aerospace, space, legal, technology, and government entities. These operations commonly followed compromise of internet-facing edge devices and exposed services such as VPN appliances, firewalls, Outlook Web Access, 3CX, and Zimbra. High-confidence associations in the content link LeslieLoader specifically to RedNovember operations and to delivery of SparkRAT; no standalone indicators of compromise for LeslieLoader are provided in the source content.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group also relies on a Go payload called Leslieloader that downloads a backdoor dubbed SparkRAT
1 distinct technique documented for this family, organized by ATT&CK tactic.
Key initial access vectors include vulnerabilities in internet-facing perimeter devices: SonicWall, Cisco ASA, Fortinet, F5 BIG-IP, and Palo Alto Networks appliances ... Exposed Outlook Web Access (OWA) and VPN infrastructure
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.