Loading story…
Sophos reported that attackers used the Buer malware-as-a-service loader to gain initial access in a Ryuk ransomware intrusion, highlighting a shift in how Ryuk affiliates were reaching victims. The intrusion began with a low-volume spear-phishing campaign that used malicious documents hosted on Google Docs, and Buer was then used to deploy a Cobalt Strike beacon that enabled lateral movement before Ryuk ransomware was launched across the network.
The report said the activity later expanded into broader spam campaigns that also delivered other loaders, including Bazar and ZLoader, suggesting overlapping delivery infrastructure and coordinated lures. Sophos described Buer as a commercial loader for Windows that supports campaign management, victim filtering, and command-and-control tasking, and noted that observed samples used a stolen DigiCert code-signing certificate along with anti-analysis features and checks designed to avoid infecting systems in CIS-region countries.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
A DigiCert-issued code-signing certificate for NEEDCODE SP Z O O was issued and was later used to digitally sign a Buer dropper observed in the Ryuk intrusion chain.
In September 2020, Sophos investigated a Ryuk ransomware intrusion in which attackers gained initial access through the Buer loader delivered via a malicious Google Docs-hosted document.
Buer was advertised on a forum on August 20, 2019 under the name "Modular Buer Loader," marking its introduction as a malware-as-a-service loader sold to cybercriminals.
Over the month following the initial low-volume spear-phishing activity, the campaign expanded into a larger spam operation delivering Buer along with other loaders including Bazar and ZLoader.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Buer Loader** emerged as a commercially sold malware downloader that operators used to compromise Windows systems and deliver follow-on payloads including **TrickBot**, **Cobalt Strike**, **KPOT**, **Amadey**, **Smoke Loader**, and activity linked to **Ryuk** ransomware. Researchers reported that it was marketed on underground forums as an off-the-shelf service with setup support and updates, then spread through multiple infection chains including macro-enabled Word documents, **malvertising**, exploit kits, Ostap-based email campaigns, and later spam waves themed around **DHL shipping** and **COVID-19** lures. Trend Micro also documented signed **XLL** files used as a delivery mechanism, including samples signed with a Sectigo-issued certificate that was later revoked. The malware later evolved from a C-based loader into a **Rust-based** variant often called **RustyBuer**, while keeping compatibility with existing command-and-control infrastructure and operator panels. Analyses described layered anti-analysis and evasion features including geofencing to avoid CIS countries, debugger and sandbox checks, virtualization detection, long or CPU-intensive delays, decoy Windows API calls, API hashing, encrypted HTTPS tasking, and persistence through **RunOnce** or **LNK** methods. Researchers were still able to extract second-stage payloads from 2021 samples by recovering embedded keys and decrypting and decompressing protected data, showing that Buer remained under active development even as its core role as a first-stage malware delivery platform stayed the same.
Aug 14, 2026
Researchers documented multiple **BazaLoader** campaigns that used high-interaction phishing lures, including Valentine’s Day retail themes and DocuSign-themed spreadsheets, to trick users into visiting spoofed sites, downloading malicious Excel files, and enabling macros. Once executed, the malware established persistence, injected into legitimate processes, contacted command-and-control infrastructure, and used evolving techniques such as updated `.bazar` domain-generation logic and heavily obfuscated strings to hinder detection and analysis. Incident reports showed BazaLoader frequently serving as an initial access loader for broader intrusions that quickly escalated to **Cobalt Strike**, **AdFind** reconnaissance, credential theft, lateral movement, and in some cases **Anchor DNS** deployment, behavior widely associated with **Ryuk** and later **Conti** ransomware operations. In one case, reconnaissance began within 41 minutes of infection; in another, attackers progressed from a single endpoint to domain controller access over five days, reinforcing assessments that BazaLoader was a key entry point in enterprise ransomware playbooks tied to TrickBot-aligned affiliates.
Aug 15, 2026
Researchers detailed how **BazarLoader** evolved as an enterprise-focused malware loader tied to the TrickBot ecosystem, using the decentralized `.bazar` namespace on EmerDNS/OpenNIC for command-and-control and rotating algorithmically generated domains each month. Early variants generated 12-character domains and later shifted to 8-character patterns built from consonant-vowel pairs, expanding the monthly candidate pool from about 2,160 to 12,996 domains; one later variant contained a coding flaw that caused many summer-month domains to become invalid, disrupting parts of its own DGA-based infrastructure. Separate reverse-engineering of BazarLoader’s infection chain showed the malware commonly arrived through phishing and malicious ISO files, where an `LNK` launched a DLL via `rundll32.exe`, unpacked shellcode, and exposed the final loader. The loader used anti-analysis checks, language-based execution filtering, dynamic API resolution, decoy traffic, cryptographic validation, and process hollowing, then fetched follow-on payloads from hard-coded HTTPS IPs or fallback `.bazar` domains to deliver tools such as **Cobalt Strike** and **Conti ransomware**.
Aug 15, 2026