TurtleLoader
TurtleLoader is a malware/detection name referenced in the provided content as Win32/TurtleLoader and TurtleLoader. It appears in a July 2021 malware/signature coverage index entry (v5.91). Separately, the content states that a Windows detection artifact for SysAid-related intrusions searches Microsoft Defender event logs for alerts related to Win32/Clop and Win32/TurtleLoader. That artifact is intended to detect post-exploitation activity associated with the LaceTempest threat actor and exploitation of a SysAid zero-day vulnerability on Windows systems. High-confidence context from the content therefore links TurtleLoader to Windows-based post-exploitation detection in SysAid compromise investigations involving LaceTempest. No additional verified details about TurtleLoader’s capabilities, infection vector, persistence, payload delivery, targeted industries, or standalone indicators of compromise are directly provided in the content beyond its Defender detection naming and its inclusion in SysAid/LaceTempest-focused detection logic.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DefenderDetection ... default: Win32/Clop|Win32/TurtleLoader
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TurtleLoader is a loader malware used to deploy additional payloads, referenced as a detection target in Defender logs in the context of SysAid 0day exploitation.
TurtleLoader [[URL_b3187638_153]] 2021 年 7 月 (V 5.91)
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.