Loading malware…
MDifyLoader is a malware loader identified by JPCERT/CC and observed in attacks exploiting Ivanti Connect Secure appliances via CVE-2025-0282 and CVE-2025-22457, both reported as exploited as zero-days in the wild. It is delivered using DLL side-loading and is based on the open-source project libPeConv. Its primary role is to load an encoded Cobalt Strike Beacon 4.5 payload directly in memory, enabling fileless post-exploitation activity.
In the reported intrusions, MDifyLoader was part of a broader toolset that also included the Go-based VShell remote access tool and the Go-based Fscan network scanner. Fscan was executed through a loader using DLL side-loading based on FilelessRemotePE. The activity described includes brute-force attacks against FTP, MS-SQL, and SSH services, use of the EternalBlue SMB exploit (MS17-010) for credential extraction and lateral movement, and persistence through creation of new domain accounts added to existing groups, as well as registering malware as services or scheduled tasks.
The reporting notes that VShell and Fscan have recently been used by Chinese hacking groups, but the provided content does not explicitly attribute MDifyLoader itself to a specific threat actor. The campaign reflects sophisticated post-compromise tradecraft focused on stealth, blending with normal operations, and maintaining long-term access in compromised environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
MDifyLoader: JPCERT/CC has released a report on MDifyLoader, a new malware they spotted installed on hacked Ivanti Connect Secure devices, via two recent vulnerabilities tracked as CVE-2025-0282 and CVE-2025-22457.
MDifyLoader: JPCERT/CC has released a report on MDifyLoader, a new malware they spotted installed on hacked Ivanti Connect Secure devices, via two recent vulnerabilities tracked as CVE-2025-0282 and CVE-2025-22457.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader associated with exploitation of Ivanti Connect Secure flaws; used to facilitate in-memory Cobalt Strike deployment (per summary).
Loader malware installed on compromised Ivanti Connect Secure devices via exploitation of CVE-2025-0282 and CVE-2025-22457 (per JPCERT/CC).
MDifyLoader is a loader malware based on the open-source project libPeConv. It loads an encrypted data file, decodes a Cobalt Strike Beacon payload, and runs it in memory, typically as part of post-exploitation activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.