Loading malware…
SynkLoader is a modular malware loader targeting Windows enterprise environments. It is distributed through Microsoft Teams spear-phishing and voice-phishing campaigns that impersonate corporate IT helpdesk personnel and persuade employees to install a fraudulent maintenance utility. Observed infections begin with a malicious MSI installer hosted on Microsoft Azure Blob Storage and rely on social engineering rather than exploitation of a Microsoft Teams vulnerability. The framework combines PowerShell, a bundled Python runtime, C#, and native DLL components, with extensive in-memory execution and malicious libraries masquerading as Microsoft runtime components.
The Python loader receives encrypted command-and-control instructions and executes supplied code in memory. Its communications use a modified ChaCha20 implementation and randomized beacon intervals. SynkLoader profiles the compromised host and Active Directory environment, collecting account and privilege information, processes, services, domain details, and domain computer counts. Persistence is established through scheduled tasks created using the Task Scheduler COM interface, avoiding reliance on the conventional task-creation command-line utility.
Its PhishLocker module presents a counterfeit Windows lock screen incorporating the current username and lock-screen background to capture plaintext login passwords. TrafficRedirector provides backconnect proxying through the infected host to internal and internet services. Additional modules support interactive PowerShell command execution, desktop streaming, and remote mouse and keyboard control. These capabilities support hands-on-keyboard intrusions and access to corporate resources. No named threat actor has been conclusively attributed to SynkLoader.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
After installation, SynkLoader can operate largely in memory and create persistence through scheduled tasks.
By using legitimate Azure Blob Storage for delivery and keeping key activity in memory, it can make a harmful download look less suspicious while reducing the traces left for defenders.
“The installer executes the script immediately... The initial PowerShell script decodes an encrypted block directly into system memory,” and a C# module “executes arbitrary PowerShell commands in memory.”
“Next, it extracts a standalone Python runtime environment and the primary loader script named ss.py. The main Python loader initiates system profiling.”
The bootstrap obtains a portable Node.js runtime and uses it to decrypt and execute the JavaScript implant from a user-writable directory.
The MSI installs a script-based loader and a separate encrypted implant file; at runtime, the loader decrypts the JavaScript implant either in memory or into a temporary JavaScript file.
They create display names such as “IT Service Desk” or “Help Desk”... The message often claims that IT needs to fix a security issue, clean a device, resolve email problems, or install an urgent update.
The opening move is simple: a message or call that appears to come from an internal IT worker.
“The initial PowerShell script decodes an encrypted block directly into system memory.”
The DLL is simply an elaborate graphical user interface (GUI), designed to mimic a Windows lock screen... the "PhishLocker" DLL prevents victims from exiting out of the screen until they provide their Windows account password.
The DLL is simply an elaborate graphical user interface (GUI), designed to mimic a Windows lock screen... the "PhishLocker" DLL prevents victims from exiting out of the screen until they provide their Windows account password.
The recovered implant communicates through randomized HTTPS long-polling requests.
Yet another creates a reverse proxy, enabling them to leverage the victim computer's IP address to route Internet traffic and reach internal services otherwise only accessible via the victim organization's local area network (LAN).
“TrafficRedirector... establishes an outbound connection to an external relay server. It routes traffic back into the local corporate network.”
The victim was persuaded to install a malicious MSI file, reportedly hosted on Microsoft Azure storage.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Memory-resident malware delivered through malicious MSI installers in Microsoft Teams IT-support impersonation lures. It establishes persistence using scheduled tasks and includes a fake-lock-screen module to capture Windows passwords in plaintext.
A malware family delivered through Microsoft Teams help-desk impersonation phishing. It is installed via a malicious MSI, operates largely in memory, establishes scheduled-task persistence, and includes the PhishLocker module to display a fake Windows lock screen and capture entered passwords in plaintext.
A script-based loader/backdoor delivered in a malicious MSI. It stages a portable Node.js runtime, decrypts and executes an obfuscated JavaScript implant, establishes randomized HTTPS C2 polling, executes operator-supplied JavaScript, performs reconnaissance and screen capture, and supports WinRM lateral movement.
A loader detection associated in this reference with the malicious MSI-based staging chain, which deploys a portable Node.js runtime and executes an encrypted JavaScript implant.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.