RomulusLoader

In recent months, however, attacks mounted by the hacking group have relied on phishing campaigns using human resources- and business-themed lures for credential phishing, fraud, and malware delivery, including Atlas RAT, RomulusLoader, and SilentRunLoader.

The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.

Once a victim clicks a link or opens an attachment, the malware silently installs itself.

The shellcode stub resolves its required Windows function addresses. It also resolves several native API functions like ZwAllocateVirtualMemory...

It then injects its code into legitimate host processes like svchost.exe or dllhost.exe .

This process hollowing routine effectively masks the attacker’s ongoing network activities from basic endpoint defenses .

To avoid detection, the loader masquerades as legitimate system components . For instance, analysts found variants mimicking the Vulkan Graphics API or AnyDesk software utilities .

It then injects its code into legitimate host processes like svchost.exe or dllhost.exe .

This process hollowing routine effectively masks the attacker’s ongoing network activities from basic endpoint defenses .

The target receives a legitimate executable file and a malicious DLL (the Atlas RAT loader) that is sideloaded into the executable’s process.

Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.

Payloads were typically installed through DLL sideloading and staged from consumer file-sharing services.

TA4922 also blends in with legitimate software, using RomulusLoader to drop remote management tools (RMT) such as AnyDesk.