Loading story…
SentinelLabs reported a new ZLoader malware campaign using a stealth-focused infection chain built around signed MSI installers, malicious Google Ads redirection, and LOLBAS techniques to reduce detection. The activity primarily targeted customers of Australian and German financial institutions and used a backdoored wextract.exe binary to help stage execution while blending into legitimate Windows activity.
The malware disabled Windows Defender and UAC, established persistence through regsvr32 and registry Run keys, and delivered the final payload by hijacking threads in msiexec.exe. Researchers linked the operation to the Tim botnet, identified more than 350 recently registered command-and-control domains, and found infrastructure overlaps with other ZLoader botnets including googleaktualizacija. The Zeus-derived banking trojan remains under active development and continues to support credential theft, web injection, backdoor access, and delivery of additional malware such as ransomware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLabs reported a new ZLoader infection chain using signed MSI installers, Google Ads redirection, LOLBAS techniques, and a backdoored wextract.exe binary to evade detection. The campaign primarily targeted customers of Australian and German financial institutions and was linked to the 'Tim' botnet with more than 350 recently registered command-and-control domains observed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026
Researchers tied the **DELoader** malware family targeting German-speaking users to the later **Zloader**/**Zeus Sphinx** banking trojan, showing how an early loader evolved into a broader modular crimeware platform. Fortinet found DELoader creating a suspended `explorer.exe`, decrypting and injecting an embedded DLL, then downloading and validating an additional PE payload from command-and-control infrastructure. Exposed victim logs and code strings indicated infections concentrated in **Germany and Austria**, while domain registration details overlapped with infrastructure previously associated with **Zeus** and **Marcher** banking malware campaigns. Later reverse engineering showed Zloader using layered obfuscation, process injection, encrypted configuration data, and a **domain generation algorithm (DGA)** that produces 20-character `.com` fallback domains from date-based seeds and embedded RC4 keys. Avast described **Zloader 2 / Silent Night** as a modular banking malware platform capable of credential theft, web injects, keylogging, screenshot capture, VNC-style remote control, cryptocurrency wallet theft, and delivery of additional payloads, with distribution through spam, fake installers, and malicious websites. Investigators also linked Zloader operations to other malware ecosystems including **Raccoon Stealer** and **Ursnif**, and noted that its botnet infrastructure became the subject of a joint **Microsoft-led takedown** effort.
Aug 15, 2026
Researchers exposed an active **LegionLoader** malware campaign, also tracked as **Satacom**, **CurlyGate**, and **RobotDropper**, that uses drive-by-download lures and short-lived redirect pages to push password-protected archives from file-sharing services such as **Mega**. The archives contain MSI installers that unpack and sideload a malicious `obs.dll`, which decrypts shellcode and a second-stage executable before using **process hollowing** into `explorer.exe` to continue execution. Analysis found heavy use of `.monster` domains, hard-coded command-and-control infrastructure, and tooling intended to download additional payloads, although some observed C2 servers were inactive during review. The activity aligns with earlier Satacom operations that abused malicious or compromised websites and fake download buttons to distribute malware disguised as free or cracked software. In prior campaigns, the loader fetched follow-on payloads through DNS TXT lookups and PowerShell, then installed a fake Chromium-based **"Google Drive"** extension that targeted cryptocurrency users by stealing wallet data, manipulating transactions, bypassing 2FA, and suppressing transaction emails across Gmail, Hotmail, and Yahoo. The newer findings indicate the operators continue to rely on staged delivery, stealthy execution, and flexible payload retrieval, while defenders have been provided with hashes, URLs, file paths, registry artifacts, and **YARA** rules to detect the campaign.
Aug 15, 2026