Loading story…
OysterLoader (aka Broomstick / CleanUp) is a C++ multi-stage loader/downloader that uses layered obfuscation and anti-analysis to evade detection and deliver follow-on payloads, and has been repeatedly tied to intrusion chains that culminate in Rhysida ransomware. The loader is primarily distributed via fake websites impersonating legitimate software (commonly IT/admin tools such as PuTTy, WinSCP, and Google Authenticator, as well as AI-themed tools), where victims are lured into downloading malicious MSI installers that are often digitally signed to appear trustworthy. Reporting attributes OysterLoader’s early public identification to Rapid7 (June 2024) and notes ongoing evolution in its codebase and tradecraft, including changes to obfuscation and command-and-control behavior.
Technical analysis describes a four-stage infection chain: (1) a TextShell packer/obfuscator, (2) custom shellcode execution, (3) an intermediate DLL downloader, and (4) the OysterLoader core. Observed capabilities include dynamic API resolution (custom hashing), API hammering, and timing-based sandbox detection, alongside a two-tier C2 architecture separating initial delivery infrastructure from final C2 used for victim interaction. While primarily associated with Rhysida operations (with reporting also linking Rhysida to the WIZARD SPIDER ecosystem), OysterLoader has also been observed delivering commodity malware such as Vidar infostealer; additional reporting indicates it can be distributed via Gootloader, and it remains unclear whether OysterLoader is proprietary to a specific actor set or offered more broadly (e.g., as a private MaaS-style capability).
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Following Sekoia's report, multiple cybersecurity news outlets summarized the research and warned that OysterLoader remained an active threat due to its advanced obfuscation, fake software distribution sites, and role in ransomware delivery. These follow-on reports did not introduce a separate incident but broadened awareness of the malware's evolution.
Sekoia released a detailed report describing OysterLoader's four-stage infection chain, TextShell packer, steganographic payload delivery, persistence via scheduled tasks, and links to Rhysida-related activity. The report highlighted the malware's continued activity and development into early 2026.
CyberProof reported that the Oyster backdoor had resurfaced in a new wave of SEO-poisoning attacks, indicating continued active distribution through search-manipulated lure sites. The report represents a later campaign update beyond earlier general threat profiling and malware analysis.
Microsoft Security Intelligence published a threat profile for Trojan:Win64/Oysterloader.AO!MTB, detailing delivery via deceptive software installers, DLL execution through rundll32, persistence through a ClearMngs scheduled task, and host reconnaissance. The write-up also described obfuscated embedded C2 domains and HTTP POST communications to api/connect and api/session endpoints.
During 2024, OysterLoader evolved its command-and-control and evasion methods, shifting from earlier fixed endpoints to newer /api/v2-style infrastructure and adding stronger obfuscation, process-list exfiltration, and dynamic encoding changes. Researchers assessed these changes as evidence of continued operator development and investment.
By mid-2024, researchers observed OysterLoader being used in intrusion chains associated with Rhysida ransomware and also delivering commodity malware such as the Vidar infostealer. Some reporting also connected its use to the broader WIZARD SPIDER ecosystem.
Rapid7 first identified OysterLoader, a multi-stage C++ malware loader also known as Broomstick and CleanUp, in June 2024. Early reporting tied it to fake software download sites and its role as an initial access and payload delivery mechanism.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritypath.com
Open sourceinfosecurity-magazine.com
Open sourcecyberpress.org
Open sourcehivepro.com
Open sourcecyberproof.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rhysida ransomware operators have leveraged Microsoft's trusted signing system to deliver the OysterLoader malware, bypassing traditional security defenses. The attackers distributed the malware through malicious advertisements, including those targeting Microsoft Teams users, exploiting the trust associated with Microsoft's digital certificates to evade detection. This technique allowed the threat actors to deploy their payloads with a higher likelihood of success, as security solutions often treat signed binaries as legitimate. The campaign involved the use of fake search ads to lure victims and facilitate the download of the malicious loader. By abusing the Microsoft trusted signing process, the attackers were able to slip their malware past endpoint protections, increasing the risk of successful ransomware deployment. Security researchers have highlighted the sophistication of this approach and the need for organizations to scrutinize even digitally signed files, as threat actors continue to find ways to exploit trusted mechanisms for malicious purposes.
Jun 29, 2026
Financially motivated threat actors have abused an illicit copy of the commercial **Shellter Elite v11.0** evasion framework since late April 2025 to build a loader delivering Lumma Stealer, ARECHCLIENT2/SECTOP RAT, and the Rhadamanthys information stealer. The campaigns used file-hosting links, phishing lures aimed at content creators, and malicious YouTube comments to distribute payloads; a shared embedded license-expiry timestamp indicates many samples may have been produced using a single compromised or illicit license. The observed SHELLTER loader encrypts payloads with **AES-128-CBC** and employs polymorphic shellcode, `ntdll` remapping and unhooking, indirect system calls, call-stack corruption, AMSI bypasses, debugger and sandbox checks, and vectored-exception-handler API proxying to hinder detection and analysis. Elastic Security Labs released YARA rules and a dynamic unpacker to help defenders identify and inspect the malicious loader and its embedded malware.
Sep 9, 2026
Researchers reported continued evolution in two prominent malware loaders used for financially motivated intrusions: **SocGholish** and **BLISTER**. Elastic said newer BLISTER variants hide malicious code inside legitimate DLLs, including **VLC Media Player** libraries, and add stronger evasion such as domain-based environmental keying, configurable anti-debugging, revised configuration fields, and unhooking techniques aimed at bypassing userland syscall-based EDR visibility. CloudSEK’s earlier analysis showed BLISTER using code-signed components, `rundll32.exe`, process hollowing, and Startup-folder persistence to deliver payloads including **Raccoon Stealer**, **Cobalt Strike Beacon**, and **BitRAT**, while Elastic linked more recent activity to deployment of the **MYTHIC** implant and to an updated **SocGholish** infection chain. Red Canary reported that **SocGholish** also changed delivery patterns, using ZIP-delivered JavaScript with filename obfuscation and **UTF-8 Cyrillic homoglyphs** to evade string-based detections, while selectively delivering second-stage malware in a subset of infections. Observed follow-on activity included host reconnaissance, Python-based persistence, browser credential theft, NTLM hash harvesting through forced authentication, and in some cases reported progression to **RansomHub** ransomware. Separate incident reporting from ReliaQuest showed how another JavaScript-based loader, **Gootloader**, enabled a long-dwell intrusion that escalated from SEO-poisoning and ZIP-delivered script execution to **SystemBC** access, LDAP discovery, Kerberoasting, RDP lateral movement, credential dumping, and exfiltration, underscoring how modern loaders are being refined as stealthy entry points for credential theft, post-exploitation, and ransomware operations.
Aug 15, 2026