ShadyHammock
ShadyHammock is a malware component/backdoor associated with TA829/RomCom activity, also tracked in overlapping reporting as Storm-0978, Void Rabisu, Nebulous Mantis, UNC2596, Tropical Scorpius, and related RomCom-linked operations. It has been observed delivered by the MeltingClaw and RustyClaw downloaders alongside DustyHammock and SingleCamper. Reporting describes ShadyHammock as a C++ component that specializes in stealth by loading the main payload—an XOR-encoded SingleCamper RAT DLL—directly from the Windows Registry into memory. The ShadyHammock DLL has been identified with the internal name loader_moder.dll; it reads and decrypts registry contents and uses a shellcode loader to deploy a newer version of the SingleCamper backdoor into memory, with the payload DLL identified as message_module.dll. This in-memory, registry-based loading behavior is consistent with evasion-focused tradecraft. In April 2025, TA829 was reported shifting to the ShadyHammock and SingleCamper tool suite in financially motivated campaigns. The broader RomCom/TA829 ecosystem has targeted organizations in Europe and North America, including financial, manufacturing, defense, logistics, government, and other sectors, and has used spear-phishing and related social-engineering delivery chains. High-confidence identifiers directly mentioned for ShadyHammock include the malware name ShadyHammock, internal DLL name loader_moder.dll, and its role in loading the SingleCamper payload DLL message_module.dll from registry-stored, XOR-encoded data.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...downloaders that deliver the ShadyHammock, DustyHammock, and SingleCamper backdoors.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealthy C++ component used to load the primary RAT payload from the Windows Registry into memory (reducing disk artifacts) and support persistence/evasion as part of a modular backdoor toolset.
Backdoor delivered by MeltingClaw/RustyClaw in TA829 intrusions.
ShadyHammock is a loader DLL that decrypts and loads the SingleCamper backdoor from registry-stored, host-encrypted payloads, providing stealthy deployment and persistence.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.