Loading malware…
ldexe is a Windows reflective loader deployed as follow-on tooling in an espionage campaign attributed to APT28, a threat group associated with Russia’s military intelligence agency, the GRU. The campaign also used the Hookedge backdoor and targeted military shipbuilding, military aircraft engine manufacturing, and law enforcement organizations in NATO member countries.
The loader accepts an encrypted payload file and a decryption key as command-line arguments. It decrypts the payload in memory and invokes an exported function to continue execution. Supplying the key only at runtime limits analysis of the encrypted payload without the corresponding execution parameters. The loader was observed on a compromised naval shipbuilder’s system during July 2026. Its encrypted payload was not recovered, leaving the payload’s ultimate functionality unknown. Credential collection, reconnaissance, and tunneling observed elsewhere in the intrusion cannot be attributed to the loader itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
« Déploiement d’un loader inédit, ld.exe, non documenté publiquement : il déchiffre sa charge utile en mémoire et nécessite une clé fournie uniquement à l’exécution en ligne de commande. »
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Un loader ld.exe a été exécuté avec un fichier chiffré Events.dat, déchiffrant son contenu en mémoire via une fonction ExecuteLoader.
« ld.exe [...] déchiffre sa charge utile en mémoire et nécessite une clé fournie uniquement à l’exécution en ligne de commande. »
T1620 — Reflective Code Loading (Defense Evasion)
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously undocumented loader deployed in the APT28 espionage campaign. Identified only by its filename, it decrypts its payload in memory using a key supplied through the command line at runtime. Symantec could not recover the final payload, so its identity and capabilities remain unknown.
Previously undocumented malicious loader identified by its executable filename. Used by APT28 during the reported campaign, it decrypts a payload in memory using a command-line key supplied at runtime. Researchers did not recover the payload, leaving its functionality unknown.
A previously undocumented reflective loader identified by its filename. It accepts an encrypted payload path and decryption key as command-line arguments, decrypts the payload in memory, and calls an exported function named ExecuteLoader. In the documented intrusion, it loaded Events.dat; that encrypted payload was not recovered, so its ultimate functionality remains unknown.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.