Loading malware…
RomulusLoader is a C-based Windows malware loader used to download and execute additional payloads from command-and-control servers. First identified in TA4922 campaigns in March 2026, it is associated with the financially motivated Chinese-speaking threat cluster whose tooling and infrastructure overlap with Silver Fox. Observed campaigns targeted organizations in Japan and Germany using localized corporate, human resources, business, and tax-themed phishing lures. Initial distribution included archives hosted on LimeWire. Subsequent campaigns used the loader to deploy legitimate remote management software, including AnyDesk and SyncFuture; a separately analyzed infection chain delivered VulcanRAT207.B.
RomulusLoader uses DLL sideloading through legitimate executables, encrypted embedded components, custom PE loading, and dynamic API resolution to execute in memory. Supported payload-execution methods include shellcode injection, process hollowing, injection into existing processes, and direct execution. It can establish persistence through a boot-triggered scheduled task running as SYSTEM when administrative privileges are available. Defense-evasion techniques include restoring Windows native-library executable sections from clean disk copies to remove user-mode hooks, concealing installed components with file attributes, and encrypting command-and-control traffic. An analyzed variant supports TCP, KCP-based reliable UDP, and HTTP/WebSocket communications. RomulusLoader is distinct from ROMULUS, an unrelated ClickFix-based malware-delivery platform.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922).
It shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922).
таа нема никакви преклопувања со RomulusLoader, семејство на малвер поврзано со Silver Fox (познат и како TA4922)
11 distinct techniques documented for this family, organized by ATT&CK tactic.
In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.
The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.
Once a victim clicks a link or opens an attachment, the malware silently installs itself.
The shellcode stub resolves its required Windows function addresses. It also resolves several native API functions like ZwAllocateVirtualMemory...
It then injects its code into legitimate host processes like svchost.exe or dllhost.exe .
This process hollowing routine effectively masks the attacker’s ongoing network activities from basic endpoint defenses .
To avoid detection, the loader masquerades as legitimate system components . For instance, analysts found variants mimicking the Vulkan Graphics API or AnyDesk software utilities .
It then injects its code into legitimate host processes like svchost.exe or dllhost.exe .
This process hollowing routine effectively masks the attacker’s ongoing network activities from basic endpoint defenses .
The target receives a legitimate executable file and a malicious DLL (the Atlas RAT loader) that is sideloaded into the executable’s process.
Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.
Payloads were typically installed through DLL sideloading and staged from consumer file-sharing services.
TA4922 also blends in with legitimate software, using RomulusLoader to drop remote management tools (RMT) such as AnyDesk.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.