Loading story…
Proofpoint reported that WikiLoader, a downloader malware family active since late 2022, has been used in campaigns targeting primarily Italian organizations and was observed delivering Ursnif payloads, including samples tied to GroupID 5050. The malware was linked first to TA544 and later to TA551, indicating it is likely shared or rented across multiple cybercriminal operations rather than used by a single actor. Delivery chains included macro-enabled Excel documents, OneNote attachments with embedded executables, and PDF lures that led victims to ZIP archives containing JavaScript downloaders.
Technical analysis of a later sample showed WikiLoader relying on layered shellcode, string deobfuscation, PEB walking for API resolution, anti-hooking checks, indirect syscall preparation, and long stalling or connectivity-validation routines to evade sandboxing and endpoint defenses. The sample injected shellcode into explorer.exe, created a mutex, collected host data, base64-encoded it, and sent it to one of eight hard-coded HTTPS endpoints using a specific HTTP cookie value; it then appeared to wait for a C2 response containing a gmail tag to obtain a decryption key for an embedded payload. Researchers said these behaviors align with Proofpoint's earlier reporting that WikiLoader remains under active development, including newer variants that use HTTP-cookie-based host-information exfiltration and evolving payload-retrieval methods such as MQTT.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
On 27 February 2024, an independent malware analysis report documented a WikiLoader sample that injected shellcode into explorer.exe, performed anti-analysis checks, exfiltrated host data via HTTP cookies, and attempted to retrieve additional payload material from hard-coded HTTPS URLs. The analyst said the execution flow closely matched prior Proofpoint research but the final stage could not be recovered because the C2 infrastructure was not responding.
On 27 July 2023, Proofpoint published research describing WikiLoader as a newly identified downloader used in at least eight campaigns since December 2022. The company said it named the malware because it requests Wikipedia and checks for the string "The Free" in the response.
On 11 July 2023, TA544 used accounting-themed emails with PDF attachments that led recipients to a zipped JavaScript downloader for WikiLoader. Proofpoint said the campaign sent more than 150,000 messages and did not exclusively target Italian organizations.
IBM X-Force reported that since mid-2023 the WailingCrab malware family, also known as WikiLoader, has used the legitimate broker.emqx.io MQTT service for backdoor command-and-control. The report detailed the malware's MQTT registration, check-in, topic subscription, payload delivery, and result reporting workflow, along with DLL side-loading and storage paths used during execution.
On 31 March 2023, TA551 delivered WikiLoader through OneNote attachments containing embedded executables. Proofpoint said this was the first observed WikiLoader use by an actor other than TA544 and that the campaign targeted Italian organizations.
On 8 February 2023, TA544 spoofed an Italian courier service in a campaign using macro-enabled Excel documents. The infection chain installed WikiLoader and then Ursnif.
On 27 December 2022, TA544 ran a campaign spoofing the Italian Revenue Agency with malicious Microsoft Excel attachments. The VBA macros in those files downloaded and executed WikiLoader.
Proofpoint first identified the WikiLoader downloader malware family in December 2022. The earliest observed campaign involved TA544, which typically targets Italian organizations and uses Ursnif as a follow-on payload.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 70 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcesecurityintelligence.com
Open sourceproofpoint.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple **Ursnif** campaigns in which the malware evolved beyond a traditional banking trojan into a stealthy loader, reconnaissance tool, and credential theft platform. In North America and Europe, attackers hijacked existing email threads and sent links to password-protected ZIP archives containing obfuscated JavaScript, while other operations used phishing lures themed as Italian courier and energy companies with malicious Office documents. The malware chain commonly relied on Windows scripting and **LOLBins** such as `wscript` and `regsvr32`, staged DLL loading, anti-analysis tricks, and geofencing or locale checks to reduce detection and limit infections to intended victims. The activity was tied to sustained, targeted operations including campaigns attributed to **TA544** against Italian organizations and a separate **LOLSnif** variant observed from 2019 into 2020. Analysts reported that the malware reused infrastructure, bypassed local proxies through COM interfaces and Internet Explorer automation, and used WMI and broken PE headers to frustrate defenders. In several intrusions, Ursnif infections led to follow-on payloads including **Cobalt Strike Beacon**, **TeamViewer/TVRat**, and a VNC-related module, showing that the campaigns supported both credential theft and broader post-compromise remote access.
Aug 15, 2026
Researchers exposed an active **LegionLoader** malware campaign, also tracked as **Satacom**, **CurlyGate**, and **RobotDropper**, that uses drive-by-download lures and short-lived redirect pages to push password-protected archives from file-sharing services such as **Mega**. The archives contain MSI installers that unpack and sideload a malicious `obs.dll`, which decrypts shellcode and a second-stage executable before using **process hollowing** into `explorer.exe` to continue execution. Analysis found heavy use of `.monster` domains, hard-coded command-and-control infrastructure, and tooling intended to download additional payloads, although some observed C2 servers were inactive during review. The activity aligns with earlier Satacom operations that abused malicious or compromised websites and fake download buttons to distribute malware disguised as free or cracked software. In prior campaigns, the loader fetched follow-on payloads through DNS TXT lookups and PowerShell, then installed a fake Chromium-based **"Google Drive"** extension that targeted cryptocurrency users by stealing wallet data, manipulating transactions, bypassing 2FA, and suppressing transaction emails across Gmail, Hotmail, and Yahoo. The newer findings indicate the operators continue to rely on staged delivery, stealthy execution, and flexible payload retrieval, while defenders have been provided with hashes, URLs, file paths, registry artifacts, and **YARA** rules to detect the campaign.
Aug 15, 2026
Zloader, a **ZeuS-derived banking trojan** that steals browser data, cookies, passwords, screenshots, and other host information, was used in multiple campaigns that combined layered delivery chains with strong evasion and persistence. Researchers documented malspam operations using **MHTML attachments**, password-protected XLS files, VBA and XLM macros, and `rundll32.exe`, as well as a later campaign that used the legitimate RMM tool **Atera** for initial access. In that operation, attackers weakened Microsoft Defender, disabled investigation tools, and abused a weakness in **Microsoft Authenticode** by appending malicious script content to Microsoft-signed DLLs while preserving a seemingly valid signature, then launching the script with `mshta.exe` and executing Zloader through `regsvr32.exe`. Across samples, Zloader commonly injected its core payload into a suspended `msiexec.exe` process, stored encrypted configuration data, and maintained persistence through Startup-folder scripts and Windows Run keys. Technical analyses showed Zloader evolving into a **modular malware platform** with anti-analysis features including encrypted strings, runtime API resolution, filename checks, process injection, and heavy **API hammering** that can generate more than a million file or registry-related calls before payload execution. Newer variants retained RC4-encrypted configuration data but added revised domain-generation logic and network protections using **RSA**, **RC4**, and Zeus BinStorage-style encryption over HTTP POST. Microsoft, ESET, Lumen Black Lotus Labs, Palo Alto Networks Unit 42, and others later disrupted three Zloader botnets by seizing **65 active command-and-control domains** and **319 DGA-generated domains**, while reporting that the malware had been tracked since 2019 across roughly **14,000 unique samples** and more than **1,300 C2 servers**, with some affiliates tied to **DarkSide ransomware**, **Cobalt Strike**, **Raccoon infostealer**, and large victim populations in North America.
Aug 15, 2026