Malware

TDL

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1542Pre-OS BootEvidence1

The boot option is changed in memory from the code executed by infected MBR... The rootkit changes this config setting value to a low level of validation that effectively allows loading of an unsigned malicious rootkit dl file.

T1542.003BootkitEvidence1

The rootkit achieves this feat by attaching itself to the master boot record in a hard drive's bowels and changing the machine's boot options.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

It uses WinNT/Turla VirtualBox kernel mode exploit technique to write code to the kernel memory and after execute this code.

T1548Abuse Elevation Control MechanismEvidence1

Administrative privilege is required. Loaded drivers MUST BE specially designed to run as "driverless".

Stealth

5 techniques

T1014RootkitEvidence2

your driver will exist in kernel mode as executable code buffer, it won't be linked to PsLoadedModuleList

T1542Pre-OS BootEvidence1

T1542.003BootkitEvidence1

The rootkit achieves this feat by attaching itself to the master boot record in a hard drive's bowels and changing the machine's boot options.

T1620Reflective Code LoadingEvidence1

It uses small shellcode which maps your driver to kernel mode without involving Windows loader (and as result without triggering any parts of DSE) and executes it.

T1622Debugger EvasionEvidence1

the rootkit uses low-level instructions to disable debuggers, making it hard for white hat hackers to do reconnaissance.

Defense Impairment

1 technique

T1553Subvert Trust ControlsEvidence1

the latest TDL4 installation penetrates 64-bit versions of Windows by bypassing the OS's kernel mode code signing policy, which is designed to allow drivers to be installed only when they have been digitally signed by a trusted source.

Discovery

1 technique

T1622Debugger EvasionEvidence1

the rootkit uses low-level instructions to disable debuggers, making it hard for white hat hackers to do reconnaissance.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

It is used as a backdoor to install and update keyloggers and other types of malware on infected machines.

Other

1 technique

T1562Impair DefensesEvidence1

TDL (Turla Driver Loader) Driver loader for bypassing Windows x64 Driver Signature Enforcement

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

r136a1 blogNews

May 7, 2026

Where Have All the Complex Windows Malware and Their Analyses Gone?

Presented as a heavyweight commodity malware family that was regularly deconstructed by researchers.

web archiveNews

Nov 18, 2010

World's most advanced rootkit penetrates 64-bit Windows • The Register

A sophisticated rootkit/backdoor that infects Windows systems by attaching to the master boot record, bypasses 64-bit Windows kernel mode code signing and PatchGuard protections, remains largely undetectable by many antimalware tools, disables debuggers, and is used to install additional malware such as keyloggers.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

TDL

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1542Pre-OS BootEvidence1

T1542.003BootkitEvidence1

The rootkit achieves this feat by attaching itself to the master boot record in a hard drive's bowels and changing the machine's boot options.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

It uses WinNT/Turla VirtualBox kernel mode exploit technique to write code to the kernel memory and after execute this code.

T1548Abuse Elevation Control MechanismEvidence1

Administrative privilege is required. Loaded drivers MUST BE specially designed to run as "driverless".

Stealth

5 techniques

T1014RootkitEvidence2

your driver will exist in kernel mode as executable code buffer, it won't be linked to PsLoadedModuleList

T1542Pre-OS BootEvidence1

T1542.003BootkitEvidence1

The rootkit achieves this feat by attaching itself to the master boot record in a hard drive's bowels and changing the machine's boot options.

T1620Reflective Code LoadingEvidence1

It uses small shellcode which maps your driver to kernel mode without involving Windows loader (and as result without triggering any parts of DSE) and executes it.

T1622Debugger EvasionEvidence1

the rootkit uses low-level instructions to disable debuggers, making it hard for white hat hackers to do reconnaissance.

Defense Impairment

1 technique

T1553Subvert Trust ControlsEvidence1

Discovery

1 technique

T1622Debugger EvasionEvidence1

the rootkit uses low-level instructions to disable debuggers, making it hard for white hat hackers to do reconnaissance.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

It is used as a backdoor to install and update keyloggers and other types of malware on infected machines.

Other

1 technique

T1562Impair DefensesEvidence1

TDL (Turla Driver Loader) Driver loader for bypassing Windows x64 Driver Signature Enforcement

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

r136a1 blogNews

May 7, 2026

Where Have All the Complex Windows Malware and Their Analyses Gone?

Presented as a heavyweight commodity malware family that was regularly deconstructed by researchers.

web archiveNews

Nov 18, 2010

World's most advanced rootkit penetrates 64-bit Windows • The Register

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.