Loading malware…
SimpleLoader is a Windows first-stage malware loader used in APT28 intrusion chains exploiting CVE-2026-21509 against government, military, diplomatic, maritime, and transport targets in Ukraine and other European countries. It is delivered after malicious Office documents trigger retrieval of external payloads, typically alongside a shortcut file, and serves as the transition point from initial exploitation to follow-on implants.
The loader is characterized by lightweight staging logic, multiple XOR-based obfuscation schemes, and support for persistence and payload deployment. Reported behavior includes generating a mutex, decrypting embedded data, writing secondary components to disk, and establishing persistence through COM hijacking. In observed campaigns it also created a temporary scheduled task to restart Explorer and trigger malicious loading via the hijacked COM object. SimpleLoader has been associated with branching execution paths that either deploy a steganography-based loader leading to an in-memory Covenant Grunt implant, or drop tooling associated with the NotDoor Outlook backdoor and BeardShell-related activity.
In the steganography branch, SimpleLoader drops a secondary DLL loader and an encrypted image containing concealed shellcode. The downstream loader performs anti-analysis checks, validates execution context, extracts shellcode from image data, and launches a .NET payload directly in memory. Subsequent stages have used legitimate cloud storage services for command-and-control, helping blend malicious traffic with normal encrypted web activity. Across reporting, the malware chain has been linked to espionage-focused operations attributed to APT28, also known as Fancy Bear or UAC-0001, with emphasis on stealth, persistence, and post-compromise access rather than disruptive effects.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Patching CVE-2026–21509 is necessary, but not sufficient. Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication) | Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication)
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malicious .doc → CVE- 2026 - 21509 exploit → LNK shortcut + SimpleLoader DLL → EhStoreShell .dll (steganography loader) → SplashScreen .png (shellcode hidden in PNG image) → CovenantGrunt (in-memory .NET backdoor) → filen .io (C2 communication)
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The vulnerability allows embedded OLE objects to execute by leveraging the WebDAV protocol to fetch external payloads from attacker-controlled infrastructure.
The loader creates a scheduled task named "OneDriveHealth" that triggers 60 seconds post-registration.
cmd.exe /c (taskkill /f /IM explorer.exe >nul 2>&1) & (start explorer >nul 2>&1)
The infection chain deploys SimpleLoader which utilizes three distinct XOR encryption schemes... and an encrypted-payload PNG file mimicking legitimate OneDrive installation artifacts.
The loader either extracts an encrypted PNG image file containing shellcode... BeardShell... processes the dropped image file, SplashScreen[dot]png, using a custom PNG parser to extract concealed .NET loader shellcode hidden within the image data.
The loader creates a scheduled task named "OneDriveHealth"... and self-deletes the scheduled task.
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DLL-based loader delivered after exploitation of CVE-2026-21509 via a malicious document and LNK shortcut, used to launch the next-stage payload EhStoreShell.
A first-stage loader delivered via malicious LNK after exploitation of CVE-2026-21509. It establishes persistence, drops EhStoreShell.dll and an encrypted PNG payload, and can also deploy the NotDoor Outlook payload.
A first-stage loader in the APT28 infection chain that establishes execution, decrypts embedded payloads, writes files to disk, and facilitates delivery of BeardShell or NotDoor.
A DLL loader in the attack chain that drops either NotDoor or the COVENANT Grunt Beacon, enabling subsequent delivery of the BEARDSHELL backdoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.