MonikerLoader
MonikerLoader is a heavily obfuscated, .NET-based loader used by the Check Point-tracked APT cluster “Silver Dragon,” assessed as operating under the China-linked APT41 umbrella. It has been observed in campaigns targeting primarily government entities in Europe and Southeast Asia since at least mid-2024.
MonikerLoader’s primary role in the intrusion chain is to decrypt and execute a second-stage loader directly in memory (reflective/in-memory loading), which then proceeds to load the final payload. In observed cases, the final payload delivered via this chain is a Cobalt Strike beacon (described as cracked variants), with C2 configurations including DNS tunneling, HTTP (including infrastructure fronted by Cloudflare), and SMB for intra-network communications.
Delivery/execution context (as reported): MonikerLoader is dropped via a RAR archive containing a batch script/installer as part of an AppDomain hijacking chain. The archive includes components such as dfsvc.exe.config and a malicious DLL (ServiceMoniker.dll) that redirects execution when dfsvc.exe runs. Execution is triggered by deleting/recreating legitimate services (e.g., DfSvc; also similar abuse of tzsync.exe was noted). MonikerLoader has been described as using a Brainfuck-based string decryption routine, and decrypting the second-stage (e.g., ComponentModel.dll) using an ADD-XOR routine before loading it into memory. Older variants reportedly stored encrypted second-stage data in the Windows Registry under HKLM\Software\Microsoft\Windows.
No standalone network indicators (domains/IPs/hashes) were provided in the supplied content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MonikerLoader is a .NET-based loader... Its primary purpose is to decrypt and execute a second-stage loader directly in memory... We identified the final payload as a Cobalt Strike beacon.
"The group leverages heavily obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory..."
MonikerLoader is a .NET-based loader... Its primary purpose is to decrypt and execute a second-stage loader directly in memory... We identified the final payload as a Cobalt Strike beacon.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
"The group leverages heavily obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
"...decrypt and inject payloads in memory" ... "including ... injected processes."
"...obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Heavily obfuscated loader used to decrypt and inject payloads in memory; ultimately used to deploy Cobalt Strike beacons.
.NET-based loader used to decrypt and execute a second-stage payload in memory; part of an infection chain that ultimately loads a Cobalt Strike beacon.
A .NET in-memory loader using Brainfuck-based string obfuscation and randomized identifiers. It decrypts and reflectively loads a second-stage module (ADD-XOR), which then configures persistence and decrypts/executes the final shellcode payload in RWX memory. Older variants may retrieve encrypted payload data from the Windows Registry. Observed final payloads are Cobalt Strike beacons.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.