Loading story…
AresLoader has been advertised as a private malware loader on the Russian-language forum XSS by a seller using the handle DarkBLUP, with access reportedly priced at $300 per month and capped at ten licenses. Researchers said the malware is marketed as legitimate-looking software that launches a decoy application while silently downloading and executing additional payloads, and can also request elevated privileges through cmd.exe before passing those rights to the delivered malware. The developers further promoted features including AES/RSA-encrypted payload support, manual code morphing, and rebuilt binaries designed to hinder signature-based detection.
Technical analysis found that AresLoader collects victim IP address and time zone data, generates a UUID, and registers with command-and-control infrastructure through a POST request carrying campaign identifiers such as an owner_token. It then downloads a benign-looking file, retrieves the malicious payload, and establishes persistence through a Registry AutoRun key. Researchers described the operation as using centralized infrastructure, with builds communicating with a single server tied to ASN AS204603 registered to Partner LLC, an environment also linked to other malicious services including a Shark stealer panel and a phishing site impersonating securespend.com.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A threat actor using the name DarkBLUP advertised the private malware loader AresLoader for sale on the Russian-language hacking forum XSS. The offering was priced at $300 per month and limited to ten licenses.
OpenAnalysis documented AresLoader's advertised features, including encrypted payload support, code morphing, and rebuilds intended to alter signatures. The analysis also identified two live panel IP addresses, 45.80.69.193 and 37.220.87.52, and published a sample SHA-256 hash associated with the loader.
Flashpoint analyzed an AresLoader sample and confirmed it collected victim IP address and time zone data, generated a UUID, registered with its C2, downloaded a decoy file, retrieved additional payloads, and established persistence via a Registry AutoRun key. The report also assessed that observed builds communicated with a centralized server hosted in Partner LLC's AS204603, which it characterized as bulletproof hosting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026
Threat researchers reported separate malware campaigns that used fake or pirated software distribution channels to infect Windows users with credential theft and traffic-interception malware. In one campaign, attackers seeded cracked software sites with a trojanized `WinX_DVD_Copy_Pro.exe` that launched an obfuscated HTA through `MSHTA`, deployed an upgraded **CountLoader v3.2**, and ultimately delivered **ACR Stealer** entirely in memory. The loader established persistence with scheduled tasks, profiled infected hosts, authenticated to command-and-control with a JWT token, and supported additional payload delivery through ZIP, DLL, MSI, PowerShell, and removable-media propagation tasks. A second campaign abused interest in **DeepSeek-R1** by promoting a fake DeepSeek site through Google Ads and delivering a malicious installer, `AI_Launcher_1.21.exe`, backed by fake CAPTCHA pages, PowerShell, AES-decrypted payloads, and a domain-generation routine. The final malware, **BrowserVenom**, installed a rogue root certificate and reconfigured browsers to send traffic through the attacker-controlled proxy `141.105.130[.]106:37121`, allowing interception and collection of user web activity. Researchers said the operations relied on impersonation-themed infrastructure and low-detection payloads to evade defenses, with BrowserVenom infections observed in Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt.
Aug 14, 2026
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026