BamboLoader
BamboLoader is a heavily obfuscated Windows shellcode loader used by the China-nexus activity cluster “Silver Dragon,” which Check Point assesses as operating within the broader APT41 umbrella. It has been observed in intrusions targeting primarily government entities in Europe and Southeast Asia since at least mid-2024.
BamboLoader is described as an x64 C++ loader employing control-flow flattening and junk code. In observed service-DLL and phishing infection chains, it functions as an in-memory loader: it reads a staged shellcode payload from disk, decrypts it using RC4 with a hardcoded key, decompresses the result using the LZNT1 algorithm (via RtlDecompressBuffer), and injects the decrypted shellcode into a legitimate Windows process (commonly taskhost.exe/taskhostw.exe; injection target is configurable). The ultimate payload delivered in these chains is a Cobalt Strike beacon (noted as cracked in the reporting).
Delivery/persistence contexts described include: (1) a “service DLL” chain where a batch script delivers BamboLoader and registers it as a Windows service / abuses legitimate Windows services for persistence via registry manipulation and service recreation to load a malicious ServiceDll; and (2) a phishing campaign using weaponized LNK attachments (noted in one case as Uzbekistan-focused) where the LNK launches PowerShell to extract embedded payloads, then uses a legitimate executable (GameHook.exe) for DLL sideloading of BamboLoader (as graphics-hook-filter64.dll) while displaying a decoy document; the encrypted Cobalt Strike payload in this chain was named simhei.dat.
Additional artifacts/paths mentioned in association with the service-DLL chain include writing the loader DLL to C:\Windows\System32\wbem and placing encrypted payloads disguised with .fon or .ttf extensions under C:\Windows\Fonts. Legitimate Windows services reported as abused for persistence include wuausrv, bthsrv, COMSysAppSrv, DfSvc, and tzsync.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A shellcode DLL loader we named BamboLoader... The loader reads the staged shellcode payload from disk, decrypts it using RC4 with a hardcoded key, and then decompresses the resulting data with the LZNT1 algorithm...
"...a phishing campaign with a malicious LNK file as an attachment, a tactic linked to Silver Dragon based on the use of similar loaders, which the researchers collectively call 'BamboLoader.'"
"...a phishing campaign with a malicious LNK file as an attachment, a tactic linked to Silver Dragon based on the use of similar loaders, which the researchers collectively call 'BamboLoader.'"
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques"Silver Dragon gains its initial access by exploiting public-facing internet servers..." ... "deployed following the compromise of publicly exposed vulnerable servers."
“The third initial-access strategy is via a phishing campaign with a malicious LNK file as an attachment…”
Execution
6 techniques"...weaponized LNK file is designed to launch PowerShell code by means of 'cmd.exe'"
“Upon execution, the LNK file launches cmd.exe, which in turn invokes PowerShell.”
“…injected into a Windows process, such as taskhost.exe, which is created as a child process.”
"The attack chain rely on ... weaponized LNK attachments."
“The batch script then deletes and recreates the legitimate DfSvc service to force a new execution of dfsvc.exe…” and “registers the BamboLoader to run as a Windows service…”
Persistence
2 techniques"It maintains persistence by hijacking legitimate Windows services" ... "hijack legitimate Windows services for persistence"
Privilege Escalation
3 techniques"...decrypt and inject payloads in memory" ... "including ... injected processes."
"It maintains persistence by hijacking legitimate Windows services" ... "hijack legitimate Windows services for persistence"
Stealth
5 techniques"The group leverages heavily obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
"...decrypt and inject payloads in memory" ... "including ... injected processes."
"...obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
“GameHook.exe – Legitimate executable abused for DLL sideloading… legitimate binary is executed in the background to sideload the BamboLoader.”
Collection
1 technique"...delivered via compressed archives..." ... "RAR archive containing a batch script" ... "*.rar ... *.7z"
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Heavily obfuscated loader used for in-memory decryption/injection and delivery of the final Cobalt Strike beacon payload.
Heavily obfuscated C++ shellcode DLL loader used to decrypt/decompress staged shellcode and inject it into a legitimate Windows process (e.g., taskhost.exe); also delivered via DLL sideloading in a phishing chain to ultimately launch Cobalt Strike.
A loader used in Silver Dragon phishing campaigns (notably via weaponized LNK attachments) to establish initial execution and facilitate delivery of follow-on tooling/payloads.
An obfuscated x64 C++ shellcode loader that establishes service-based persistence by hijacking legitimate Windows services, decrypts staged payloads (RC4) and decompresses them (LZNT1 via RtlDecompressBuffer), then injects the resulting shellcode into a spawned process (e.g., taskhostw.exe). Observed final payloads are Cobalt Strike beacons.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.