Loading story…
Sophos reported on Shanya, a packer-as-a-service offering that helps threat actors conceal malicious payloads and complicate detection during intrusions. The service is designed to wrap malware in layers of obfuscation so it can evade static analysis, frustrate reverse engineering, and reduce the effectiveness of signature-based defenses, making it attractive to a range of operators seeking to improve delivery and execution success.
The report indicates Shanya is part of the broader criminal ecosystem that commercializes offensive tooling for affiliates and other attackers, lowering the barrier to entry for malware deployment. By outsourcing packing and evasion capabilities to a dedicated service, adversaries can more easily refresh payloads, bypass security controls, and sustain campaigns with less in-house development effort, reinforcing the role of malware-packaging services in modern attack chains.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released a threat research report detailing Shanya as a packer-as-a-service used to help deliver and obfuscate modern malware attacks. The reference does not provide earlier dated events, so the publication itself is the only distinct event supported by the content provided.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple ransomware groups have begun leveraging a new packer-as-a-service platform called **Shanya Crypter** to bypass endpoint detection and response (EDR) solutions. Shanya Crypter utilizes kernel driver abuse to terminate EDR processes, making ransomware payloads significantly harder to detect and stop. The service provides custom wrappers for each customer, employing unique encryption algorithms and memory injection techniques that avoid writing payloads to disk, further complicating detection by traditional security tools. Notable ransomware groups such as Medusa, Qilin, Crytox, and Akira have been confirmed to use Shanya, with attacks observed in regions including Tunisia, the UAE, Costa Rica, Nigeria, and Pakistan. The emergence of Shanya Crypter marks a significant evolution in ransomware delivery tactics, as it enables threat actors to deploy EDR-killing payloads with greater stealth and efficiency. Security researchers have highlighted the technical sophistication of Shanya, including its use of non-standard module loading and the ability to generate unique stubs for each customer. This development underscores the ongoing arms race between ransomware operators and defenders, with attackers increasingly turning to advanced packing and obfuscation services to maintain the effectiveness of their campaigns.
Jun 29, 2026
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Recorded Future's Insikt Group identified a competitive underground market of at least 24 active malware crypting service providers selling tools that modify malicious payloads to evade antivirus and endpoint defenses. The offerings are marketed across underground forums, restricted communities, messaging platforms, clearnet sites, and social media, with most focused on Windows payloads and advertising bypasses for **Microsoft Defender**, **SmartScreen**, **AMSI**, **ETW**, Chrome warnings, and broader AV/EDR controls. The services go beyond basic packing or encryption and increasingly bundle broader malware-enablement features, including **in-memory execution**, **anti-VM and anti-sandbox checks**, **process injection**, **persistence**, delivery packaging, polymorphic or per-build stubs, and re-crypting after detection. Sellers support formats such as `EXE`, `DLL`, `.NET`, scripts, Office files, PDFs, MSI packages, APKs, and shortcut-based launchers, with pricing ranging from tens of dollars to tens of thousands; while most vendors show no confirmed ties to malware developers, some listings suggest possible links to actors or families including **TrickBot**, **Conti**, **Agent Tesla**, **PureRAT**, and **BianLian**, underscoring how established defense-evasion techniques are being commercialized for wider criminal use.
Aug 14, 2026