Loading story…
The Andromeda botnet, also tracked as Gamaru and Wauchos, operated for years as a modular Windows malware platform that steadily added stronger evasion, persistence, and command-and-control features. Analyses of versions including 2.7 through 2.10 show layered packing, anti-debugging and anti-VM checks, process injection and hollowing, watchdog-based self-repair, registry and autorun persistence, and encrypted HTTP communications using RC4, with later variants shifting to JSON-formatted C2 messages. The malware commonly spread through spam, phishing, compromised websites, illegal download portals, and exploit kits including Neutrino, Nuclear, Angler, and Rig, while using plug-ins for capabilities such as keylogging, form grabbing, rootkit functions, hidden TeamViewer access, and downloading additional malware.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
The Virus Bulletin review states that underground forum posts suggested Andromeda development stopped around 2017. The same review notes that a 2017 takedown effort and arrest of a suspected Belarusian administrator may have marked the botnet's end.
Avast reported that the analyzed newer Andromeda variant began spreading at the beginning of 2016. The variant relied on layered packing, custom encryption, anti-analysis protections, process injection into msiexec.exe, and RC4-encrypted HTTP C2 traffic.
Trend Micro reported that infrastructure centered on IP address 80.242.123.144, used in an Andromeda-to-GamaPoS campaign, had been active since the first week of May 2015. The campaign used spam documents and exploit-kit infections to download Andromeda.
In a 2015 campaign, Andromeda served as the initial access mechanism for distributing GamaPoS point-of-sale malware, primarily against U.S. businesses. After infection, Andromeda deployed tools including PsExec, mimikatz, .NET downloaders, and in some cases the GamaPoS payload.
The latest Andromeda version discussed in the review, version 2.10, was first seen in 2015. This version switched its C2 message format to JSON while continuing to use RC4 encryption and moved more anti-analysis logic into the payload.
Andromeda, also known as Gamaru or Wauchos, was first discovered in the wild in 2011. Multiple references describe it as a modular HTTP-based botnet that surfaced around that year.
Fortinet's ART team reported that the Andromeda botnet was downloading a newly discovered .NET multifunctional botnet called Proteus. Proteus supported proxying, cryptocurrency mining, account checking, keylogging, and downloading additional malware.
A new Andromeda 2.7 version was observed in the wild with stronger self-defense, persistence, and stealth features than earlier variants. Its protocol and encryption changes also rendered older Andromeda IPS/IDS signatures ineffective.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
virusbulletin.com
Open sourcefortinet.com
Open sourceblog.avast.com
Open sourcevirusbulletin.com
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Amadey** has evolved from an information-stealing bot into a broader malware delivery platform, with newer variants adding screenshot capture, expanded credential theft, clipboard hijacking, and delivery of follow-on payloads such as **Remcos RAT**, **RedLine Stealer**, and **LockBit 3.0**. Recent analyses said the malware is being distributed through multiple channels including the **RIG Exploit Kit**, phishing emails, fake software installers, torrent-distributed cracks and keygens, malicious Office documents, and gaming cheat sites. Once executed, Amadey typically profiles the host, checks for security products, establishes persistence through registry changes, scheduled tasks, or startup-folder abuse, and communicates with command-and-control servers over plain HTTP to fetch plugins and additional malware. Multiple reports said Amadey operators are using modular DLL components such as `cred.dll`, `scr.dll`, `clip64.dll`, and newer credential-stealing plugins to harvest browser, remote access, FTP, Outlook, and MikroTik data while also capturing screenshots and replacing cryptocurrency wallet addresses in the clipboard. Long-term infrastructure tracking found hundreds of active Amadey C2 servers and thousands of secondary payloads, showing that the malware has become a durable **loader-as-a-service** platform with ties to overlapping criminal campaigns. Analysts also observed delivery chains involving SmokeLoader and Nitol, abuse of public-interest lures such as fake KakaoTalk updates, and continued use of Amadey to stage ransomware and remote-access infections on compromised Windows systems.
Aug 15, 2026
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026