Loading story…
Researchers detailed two malware loaders used to establish initial access and stage follow-on intrusions: SquirrelWaffle, which arrived through phishing documents and dropped VBS and PowerShell components before retrieving a packed 32-bit DLL, and Bumblebee, which was delivered through compromised open-source tools in an MSI installer containing a CAB archive. In the SquirrelWaffle chain, the DLL dropper unpacked shellcode using XOR/ROR logic and APLIB decompression, then loaded a payload exported as ldr that collected host data, decrypted embedded configuration, and extracted command-and-control IP addresses and domains. The malware communicated over standard WS_32 socket APIs and downloaded Cobalt Strike, saving the binary with a .txt extension before execution.
Analysis of Bumblebee showed a different but similarly stealthy execution path built around DLL sideloading and DLL proxy forwarding. The installer abused the legitimate Microsoft-signed icardagt.exe binary to load a malicious DLL that was renamed to version.dll at runtime, while anti-analysis features included junk code, timing checks, and possible virtual-machine detection through WMI queries. Investigators also observed failed file-creation attempts, a network connection to 19ak90ckxyjxc.life, a temporary installation directory, and a Windows Installer UserData registry artifact, reinforcing that the MSI package orchestrated the full infection chain and positioned the malware for later hands-on-keyboard activity or ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2025-06-15, a malware analysis described a Bumblebee sample delivered through compromised open source tools via an MSI installer. The report documented DLL sideloading and proxy forwarding using the legitimate Microsoft-signed icardagt.exe binary, along with anti-analysis behavior and a connection to 19ak90ckxyjxc.life.
On 2021-09-21, a technical analysis detailed SquirrelWaffle's custom crypter, shellcode-based unpacking, configuration decryption, and C2 extraction. The report also noted similarities to crypters seen in Ursnif, Zloader, and Hancitor and warned of its potential role in later ransomware intrusions.
The SquirrelWaffle malware loader was first observed in early to mid-September 2021 delivering the Cobalt Strike framework. The analysis describes a phishing-based infection chain that drops VBS and PowerShell components before downloading the loader DLL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers reported two newly documented Windows malware loaders, **Kiss Loader** and **DeepLoad**, in emerging campaigns that rely on stealthy execution and social engineering to deliver follow-on malware. G DATA said Kiss Loader was delivered through phishing emails using Internet Shortcut (`.url`) files disguised as PDFs, which retrieved payloads through a TryCloudflare tunnel and an exposed WebDAV repository. The loader established persistence, showed a decoy PDF, downloaded additional components, and deployed malware including **VenomRAT** and a `.NET Reactor`-protected sample identified as **Kryptik**. DeepLoad was distributed through the **ClickFix** technique, tricking victims into pasting malicious PowerShell into the Windows Run dialog before launching `mshta.exe` and obfuscated PowerShell to execute the infection chain. Researchers said the malware used **APC injection**, AI-assisted obfuscation, randomized `Add-Type` DLL compilation, PowerShell history suppression, abuse of legitimate processes such as `LockAppHost.exe`, and **WMI event subscriptions** for persistence and reinfection. Its objectives included browser credential theft, deployment of a malicious browser extension to capture logins, and propagation through removable media with deceptive `.lnk` filenames, while Kiss Loader similarly used **Early Bird APC injection** into `explorer.exe` to evade detection and run payloads in memory.
Jun 29, 2026