SimpleLoader
SimpleLoader is a first-stage DLL loader used in APT28/Fancy Bear/UAC-0001 espionage campaigns, including activity described as Operation Neusploit. It was delivered after exploitation of Microsoft Office vulnerability CVE-2026-21509 via malicious DOC/RTF spear-phishing documents that used embedded OLE objects and WebDAV to retrieve external payloads, including a malicious LNK shortcut and the SimpleLoader DLL. Reported targeting included European military, government, maritime, transport, diplomatic, and especially Ukrainian and other Eastern European organizations.
SimpleLoader is described as using three XOR-based schemes: single-byte XOR 0x43 for mutex generation, alternating-byte XOR with null padding for path obfuscation, and a 76-character rotating XOR key for embedded payload decryption. It established persistence via COM hijacking of CLSID {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32 and created a temporary scheduled task named OneDriveHealth to restart explorer.exe and trigger the hijacked COM object. The mutex adjgfenkbe is associated with SimpleLoader.
In the observed infection chain, SimpleLoader wrote EhStoreShell.dll to C:\ProgramData\USOPublic\Data\User\EhStoreShell.dll and dropped an encrypted PNG payload at C:\ProgramData\Microsoft OneDrive\setup\Cache\SplashScreen.png. EhStoreShell.dll acted as a steganography loader, validated execution conditions including explorer.exe and anti-analysis timing checks, decoded shellcode hidden in the PNG, and launched an in-memory .NET CovenantGrunt implant. In another reported branch, SimpleLoader was responsible for dropping either NotDoor or a COVENANT Grunt beacon that contacted filen.io to deliver the BeardShell backdoor. Associated post-compromise behavior included use of filen.io for C2 over HTTPS, reconnaissance with arp.exe, systeminfo.exe, and tracert.exe, and process injection into svchost.exe.
Known indicators directly associated with this malware chain include SHA-256 0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e for SimpleLoader, SHA-256 a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1 for EhStoreShell.dll, the COM hijack registry path HKCU\Software\Classes\CLSID{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32, and the scheduled task OneDriveHealth.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Patching CVE-2026–21509 is necessary, but not sufficient. Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication) | Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication)
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication)
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
The vulnerability allows embedded OLE objects to execute by leveraging the WebDAV protocol to fetch external payloads from attacker-controlled infrastructure.
Execution
5 techniques
Execution
The loader creates a scheduled task named "OneDriveHealth" that triggers 60 seconds post-registration.
cmd.exe /c (taskkill /f /IM explorer.exe >nul 2>&1) & (start explorer >nul 2>&1)
Persistence
4 techniques
Persistence
Privilege Escalation
4 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
The infection chain deploys SimpleLoader which utilizes three distinct XOR encryption schemes... and an encrypted-payload PNG file mimicking legitimate OneDrive installation artifacts.
The loader either extracts an encrypted PNG image file containing shellcode... BeardShell... processes the dropped image file, SplashScreen[dot]png, using a custom PNG parser to extract concealed .NET loader shellcode hidden within the image data.
The loader creates a scheduled task named "OneDriveHealth"... and self-deletes the scheduled task.
IOCs tracked for this family
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DLL-based loader delivered after exploitation of CVE-2026-21509 via a malicious document and LNK shortcut, used to launch the next-stage payload EhStoreShell.
A first-stage loader delivered via malicious LNK after exploitation of CVE-2026-21509. It establishes persistence, drops EhStoreShell.dll and an encrypted PNG payload, and can also deploy the NotDoor Outlook payload.
A first-stage loader in the APT28 infection chain that establishes execution, decrypts embedded payloads, writes files to disk, and facilitates delivery of BeardShell or NotDoor.
A DLL loader in the attack chain that drops either NotDoor or the COVENANT Grunt Beacon, enabling subsequent delivery of the BEARDSHELL backdoor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.