Diaoyu Loader
Diaoyu Loader is a custom malware loader used in phishing-led intrusion chains attributed by Palo Alto Networks Unit 42 to the cyber-espionage cluster TGR-STA-1030, also referred to as UNC6619. It was delivered in ZIP archives hosted on MEGA and sent via phishing emails, alongside a zero-byte file named pic1.png that functions as part of its execution guardrail. Unit 42 reported the executable metadata showed an original name of DiaoYu.exe.
The loader uses dual-stage anti-analysis and environmental checks before proceeding. Reported guardrails include requiring a horizontal screen resolution of at least 1440 and verifying that pic1.png is present in the execution directory; if the file is absent, execution terminates. It also checks for specific security products by process name, including Avira (SentryEye.exe), Bitdefender (EPSecurityService.exe), Kaspersky (Avp.exe), SentinelOne (SentinelUI.exe), and Symantec/Norton (NortonSecurity.exe).
After passing these checks, Diaoyu Loader downloads additional files from a GitHub repository associated with padeqav/WordPress, including image files such as admin-bar-sprite.png, Linux.jpg, and Windows.jpg. These downloaded images were reported to act as conduits for deployment of a Cobalt Strike payload, and the loader’s end result was installation of Cobalt Strike. The associated GitHub account was no longer available at the time of reporting.
Diaoyu Loader was observed in a broader espionage campaign active from at least January 2024 and publicly reported in February 2026. Unit 42 stated TGR-STA-1030 compromised at least 70 government and critical infrastructure organizations across 37 countries and conducted reconnaissance against government infrastructure associated with 155 countries. Targeting focused primarily on government ministries and departments, including law enforcement, border control, finance, economic, trade, natural resources, diplomatic, and other critical infrastructure entities. In some cases, the actor maintained access for months and exfiltrated sensitive data from victim email servers and file shares, including financial negotiations, contracts, banking information, and military-related operational updates.
High-confidence indicators and artifacts directly associated with Diaoyu Loader in the reporting include the filenames pic1.png, admin-bar-sprite.png, Linux.jpg, Windows.jpg, the original executable name DiaoYu.exe, and GitHub/raw.githubusercontent[.]com infrastructure tied to padeqav/WordPress.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“...These emails delivered a ZIP archive containing the Diaoyu Loader... The Diaoyu Loader is a custom malware that downloads additional payloads from a GitHub repository... deploying a Cobalt Strike payload.”
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
2 techniques
Stealth
Discovery
2 techniques
Discovery
Command and Control
1 technique
Command and Control
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom loader delivered via phishing that retrieves additional payloads (including content used to stage/deploy Cobalt Strike) and performs AV product checks prior to execution to improve evasion.
A multi-stage loader delivered via phishing that uses environment/sandbox guardrails (screen resolution check and presence of a specific file) and then retrieves additional content used to deploy a follow-on Cobalt Strike payload.
Phishing-delivered loader that uses anti-sandbox guardrails (screen resolution check and presence of a decoy/auxiliary file pic1.png), performs limited AV process checks, downloads additional components from GitHub, and culminates in installing a Cobalt Strike payload.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.