MalwareUsed by 1 actor

Appsalt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Larva-25012

Appsalt est distribué avec un chargeur et la DLL SDK appsalt.dll, sous une tâche SecurityHealthServiceSyncUpdate et un chemin imitant Microsoft\Servicing.

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

« Enregistré dans le Planificateur de tâches Windows pour persistance » ; les proxywares créent notamment les tâches PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate et BackgroundTaskRegistrationMaintenanceTaskScheduler.

T1059.001PowerShellEvidence1

“DPLoader… can also perform PowerShell command execution based on the C&C server’s response. All PowerShell commands downloaded were of the type that install Proxyware.”

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

Stealth

2 techniques

T1036MasqueradingEvidence1

“they utilized GitHub by disguising the Proxyware as a Steam client cleanup tool” and loaders were installed under names such as “copilotservice.exe” and “securityhealthservicesyncupdate.exe.”

T1036.005Match Legitimate Resource Name or LocationEvidence1

Les chemins et noms imitent des composants Windows légitimes, notamment « Microsoft\Copilot\Services », « Microsoft\Servicing » et « Microsoft\TaskRegistrationMaintenanceTask ».

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

« Exécute des commandes PowerShell reçues du C2 pour installer le Proxyware » ; des scripts PowerShell, exécutables et DLL sont accessibles depuis des URL CloudFront et R2.

Impact

1 technique

T1496Resource HijackingEvidence2

« Une attaque de proxyjacking consiste à installer discrètement un Proxyware sur un système compromis afin de partager sa bande passante internet avec des tiers, générant des revenus pour l’acteur malveillant ».

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Sep 22, 2026

Larva-25012 : campagne de distribution de Proxyware via DPLoader en 2026 | CyberVeille

Proxyware installé avec un chargeur et une DLL SDK, avec persistance et masquage par imitation de chemins et noms de services Microsoft.

ahnlab asec blogNews

Sep 16, 2026

Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal) - ASEC

SDK-based proxyware installed with a loader that calls its initialization function using the threat actor’s token to monetize the compromised system’s available bandwidth.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Appsalt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Larva-25012

Appsalt est distribué avec un chargeur et la DLL SDK appsalt.dll, sous une tâche SecurityHealthServiceSyncUpdate et un chemin imitant Microsoft\Servicing.

via cyberveillecyberveille.ch

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1053.005Scheduled TaskEvidence2

T1059.001PowerShellEvidence1

“DPLoader… can also perform PowerShell command execution based on the C&C server’s response. All PowerShell commands downloaded were of the type that install Proxyware.”

Persistence

1 technique

T1053.005Scheduled TaskEvidence2

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence2

Stealth

2 techniques

T1036MasqueradingEvidence1

T1036.005Match Legitimate Resource Name or LocationEvidence1

Les chemins et noms imitent des composants Windows légitimes, notamment « Microsoft\Copilot\Services », « Microsoft\Servicing » et « Microsoft\TaskRegistrationMaintenanceTask ».

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

« Exécute des commandes PowerShell reçues du C2 pour installer le Proxyware » ; des scripts PowerShell, exécutables et DLL sont accessibles depuis des URL CloudFront et R2.

Impact

1 technique

T1496Resource HijackingEvidence2

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyberveilleNews

Sep 22, 2026

Larva-25012 : campagne de distribution de Proxyware via DPLoader en 2026 | CyberVeille

Proxyware installé avec un chargeur et une DLL SDK, avec persistance et masquage par imitation de chemins et noms de services Microsoft.

ahnlab asec blogNews

Sep 16, 2026

Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal) - ASEC

SDK-based proxyware installed with a loader that calls its initialization function using the threat actor’s token to monetize the compromised system’s available bandwidth.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.