Loading story…
Fortinet disclosed a FIN7-attributed malware loader named BIOLOAD that abuses Windows DLL search order hijacking to execute malicious code through the legitimate binary FaceFodUninstaller.exe. In the observed technique, attackers place a rogue WinBio.dll in the WinBioPlugIns directory so the scheduled task FODCleanupTask launches the trusted executable, which then loads the attacker-controlled DLL. Researchers said BIOLOAD appears tailored to individual victim machines, uses XOR-based decryption partly keyed to the computer name, and carries a single embedded payload: a newer Carbanak backdoor variant.
The report links BIOLOAD to FIN7’s BOOSTWRITE based on shared code and PE-loading logic, but describes BIOLOAD as a simpler, likely earlier variant that still required elevated privileges for deployment. Microsoft’s documentation on Windows DLL resolution helps explain the abuse: when applications do not specify a full path, Windows searches for DLLs according to a defined order, and attackers who control a searched directory can plant a malicious library for hijacking. Microsoft notes that defenders can reduce this risk by constraining DLL loading behavior with safer search settings and APIs such as LoadLibraryEx, SetDefaultDllDirectories, and AddDllDirectory.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Fortinet publicly introduced BIOLOAD as a malware loader attributed to FIN7 that abuses DLL search order hijacking via FaceFodUninstaller.exe and a malicious WinBio.dll. The report linked BIOLOAD to BOOSTWRITE and said its embedded payload was a Carbanak backdoor variant.
Fortinet noted that related FIN7 BOOSTWRITE samples targeting 32-bit machines were compiled and signed in May 2019. This helped researchers compare BIOLOAD with previously documented FIN7 tooling.
The Fortinet analysis states that BIOLOAD samples targeting 64-bit systems were compiled in March and July 2019. The loader was developed in C++ and tailored per victim machine.
Fortinet reported that the Carbanak backdoor payloads extracted from BIOLOAD included newer builds whose timestamps dated to January and April 2019. These timestamps indicate the malware family components used in the campaign were built by that time.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FIN7 has continued to evolve its malware delivery and post-compromise tooling, with multiple reports tying the group to campaigns that use malicious Excel add-ins (`.xll`) to deliver a rewritten **JSSLoader**. Malwarebytes reported a late-June malspam operation in which an XLL component launched JSSLoader and dropped a secondary .NET payload, while later reporting from Morphisec and Secureworks also linked new JSSLoader activity to Excel add-ins. Researchers said the newer JSSLoader variants expand on earlier versions with added functionality, including enhanced data-exfiltration capabilities. The activity fits a broader pattern in FIN7 intrusions documented by Mandiant, which showed the group shifting from older loaders such as **LOADOUT** and **GRIFFON** toward more flexible access tools including **POWERPLANT** and **Cobalt Strike BEACON**, while continually rewriting malware to evade detection. Mandiant also described FIN7 using compromised RDP credentials, shellcode loaders, reconnaissance, Kerberoasting, and customized backdoors, underscoring that the latest JSSLoader delivery chain is part of a longer-running effort by the financially motivated group to refine initial access, persistence, and follow-on intrusion capability.
Aug 15, 2026
Morphisec reported that **FIN7** launched two campaigns against restaurant and hospitality organizations using password-protected Microsoft Word documents with Russian-language lures and branding themed around Finjan’s InvinciBull VPN. Victims were prompted to enable macros, which extracted obfuscated JavaScript, copied and renamed `wscript.exe` to `mses.exe` to reduce some EDR visibility, and installed a JavaScript backdoor that contacted command-and-control domains including `bing-cdn[.]com` and `googleapi-cdn[.]com`. The malware transmitted limited host profiling data such as MAC address and computer domain, indicating the operators were likely filtering victims before delivering additional payloads. The activity fits long-observed **FIN7** tradecraft documented by Mandiant and Splunk, including lure documents tied to malware families such as **CARBANAK**, **GRIFFON**, **BATELEUR**, **POWERSOURCE**, and **BEACON**, as well as JavaScript-based loaders that use WMI, ActiveX, and HTTP or DNS for reconnaissance and command-and-control. The new campaign also underscores FIN7’s resilience after multiple U.S. prosecutions of senior members, including recruiter Andrii Kolpakov’s guilty plea and administrator Fedir Hladyr’s prison sentence, while prior reporting has linked the group to large-scale payment-card theft and later expansion into ransomware-related operations.
Aug 15, 2026
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026