Loading malware…
PicassoLoader is a Windows payload downloader associated with the Belarus-linked cyberespionage actor Ghostwriter, also tracked as FrostyNeighbor, UAC-0057, and UNC1151. Implementations have been observed in .NET, PowerShell, JavaScript, and C++. It stages additional malware, notably Cobalt Strike Beacon, and has been used in operations targeting Ukrainian government, military, and critical energy-sector organizations.
Delivery mechanisms include malicious macro-enabled Microsoft Office documents, spearphishing emails carrying PDF lures that link to malicious archives, and exploitation of the WinRAR vulnerability CVE-2023-38831. Infection chains commonly display legitimate-looking decoy documents while malicious scripts execute in the background. Payloads can be disguised as images or concealed within web-associated files; an observed JavaScript implementation extracted and decrypted a .NET payload embedded in an SVG image using the Rabbit algorithm.
JavaScript variants profile compromised systems by collecting usernames, computer names, operating-system versions, boot times, and running processes. In a campaign active since March 2026, PicassoLoader transmitted host profiles through HTTP POST requests every ten minutes and executed JavaScript returned by its command-and-control server. Operators selectively deployed a subsequent Cobalt Strike dropper after reviewing victim information. The associated delivery infrastructure used geographic filtering to serve malicious archives to Ukrainian IP addresses while returning benign documents to other visitors, limiting exposure to automated analysis.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Multiple VBS and Bat. files are created and launched to deploy the next-stage of malware named PicassoLoader malware to target the Ukrainian critical energy sector.
Analysis of Dwnldr.dll shows that it is a DLL file with a .NET assembly embedded inside. The file is protected with ConfuserEx... The DLL file hosts a payload that appears to be a simplified variant of PicassoDownloader, a malware family also linked to Ghostwriter activity... Analysis of techniques used by threat actors can often be helpful in establishing the origin of the attack and the malware it uses. In this case... allowing us to establish a medium confidence link between them and a malware cluster known as PicassoLoader, a downloader toolkit.
Analysis of Dwnldr.dll shows that it is a DLL file with a .NET assembly embedded inside. The file is protected with ConfuserEx... The DLL file hosts a payload that appears to be a simplified variant of PicassoDownloader, a malware family also linked to Ghostwriter activity... Analysis of techniques used by threat actors can often be helpful in establishing the origin of the attack and the malware it uses. In this case... allowing us to establish a medium confidence link between them and a malware cluster known as PicassoLoader, a downloader toolkit.
Analysis of Dwnldr.dll shows that it is a DLL file with a .NET assembly embedded inside. The file is protected with ConfuserEx... The DLL file hosts a payload that appears to be a simplified variant of PicassoDownloader, a malware family also linked to Ghostwriter activity... Analysis of techniques used by threat actors can often be helpful in establishing the origin of the attack and the malware it uses. In this case... allowing us to establish a medium confidence link between them and a malware cluster known as PicassoLoader, a downloader toolkit.
For Ukrainian IP addresses, it delivers a RAR archive containing a JavaScript file. This file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
Key developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.
+1 more in the app. View in Mallory
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Tactic ID Name Resource Development T1583 Acquire Infrastructure
T1588.002 Obtain Capabilities: Tool
Tactic ID Name Resource Development T1583 Acquire Infrastructure T1608 Stage Capabilities
These tactics range from using phishing emails containing malicious ZIP files to deploying different families of malware.
CERT-UA ... зафіксовано сплеск активності угрупування UAC-0057, що полягала в розповсюдженні документів з макросами ... Вміст виявлених файлів ... стосувався реформи органів місцевого самоврядування ... оподаткування, а також тематики фінансово-економічних показників.
SentinelLABS analyzed an attack that started with a Google Drive shared document landing in the target’s inbox... The email link pointed to a downloadable RAR archive, containing a malicious Excel workbook.
Хостові: ... System service (заплановане завдання)
As a result the program bypasses the harmless file and instead locates and executes a batch or CMD script.
Upon running the cmd file, multiple VBS and Bat. files are created and launched to deploy the next-stage of malware named PicassoLoader.
та виконання JavaScript-коду, призначеного для завантаження зображення "113-1131910-clipart.svg", отримання за зміщенням та дешифрування за допомогою алгоритму Rabbit .NET-файлу
When a victim double-clicks on the PDF, the vulnerability will quietly launch a script in the folder to install malware on the device.
The XLS document contains an obfuscated VBA macro which is activated when the document is opened and the user allows Office macros to run.
Хостові: ... System service (заплановане завдання)
Later, it is registered to load during autostart by leveraging the Registry Run key: HKCU\System\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Certificate Center
Хостові: ... System service (заплановане завдання)
Later, it is registered to load during autostart by leveraging the Registry Run key: HKCU\System\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Certificate Center
The file is protected with ConfuserEx... For this script, the attackers used a popular obfuscator tool called Macropack.
T1027.009 Obfuscated Files or Information: Embedded Payloads
Once the file is downloaded, it is renamed and then saved to %APPDATA%\Roaming\Microsoft\SystemCertificates\CertificateCenter.dll ... This suggests that the CertificateCenter.dll file is not a binary as the file extension would suggest but rather contains program source code.
T1036.005 Masquerading: Match Legitimate Resource Name or Location
It does so by decrypting additional code of the assembly.
It launches an LNK file by using Mshta.exe utility that leads to the execution of the HTA file.
The DLL file is loaded with the following command line invocation: C:\Windows\System32\regsvr32.exe /u /s "C:\Temp\Realtek(r)Audio.dll"
the .NET ConfuserEx-obfuscated Downloader DLL ... is loaded with rundll32.exe and respective commandline arguments to run an exported function.
As a part of application protection provided by the obfuscator, the Downloader creates a copy of itself in memory, and then modifies it... It also uses a clever evasion technique, altering its own PE header in memory and breaking internal links to the .NET assembly.
This file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
Мережеві: backstagemerch[.]shop, empoweringparents[.]shop, lauramcinerney[.]shop ... https://backstagemerch.shop/the-simpsons/mens-freeze.html ...
Command and Control T1071.001 Application Layer Protocol: Web Protocols
Konni actors start downloading a final payload by contacting its C2 server.
...with responses disguised as image files while actually delivering XML configuration data.
This file executes a JavaScript version of PicassoLoader, the group's payload downloader, which collects system information and sends it to attacker-controlled servers.
136 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.