Loading story…
SquirrelWaffle was used in phishing campaigns that delivered malicious ZIP archives containing Word or Excel documents, then relied on VBA or XLM macros to launch a multi-stage infection chain. In documented cases, the documents dropped a VBS script or invoked PowerShell to download DLL payloads, which were executed with rundll32 or regsvr32 and ultimately fetched follow-on malware including Cobalt Strike and, in some campaigns, Qakbot. Traffic analysis of one observed intrusion showed the loader arriving from an email-delivered ZIP file, infecting a Windows host, and then transitioning into Cobalt Strike activity on the network.
Reverse-engineering reports show the SquirrelWaffle DLL loader used a custom packer and several anti-analysis measures, including manual rebasing, junk API padding, in-memory decryption, and remapping of a second-stage PE into the current process. The main loader decoded hardcoded C2 URLs, collected host data such as computer name, username, domain, local IP address, and APPDATA path, and sent that information in HTTP POST requests before acting on server responses. Depending on the returned tasking, it could drop and register executables, run payloads from TEMP, execute shellcode through a threadpool wait callback, or write and launch an operator-specified executable path.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On 20 September 2021, researchers observed a new Squirrelwaffle variant using malicious Excel documents instead of Word documents. This variant used XLM macros, downloaded masqueraded DLL payloads from C2 servers, and executed them via regsvr32.
On 2021-09-17, a malware infection involving the Squirrelwaffle loader followed by Cobalt Strike was documented. The incident involved a malicious ZIP archive delivered by email, a Word document, host artifacts, and captured network traffic showing when Cobalt Strike activity began.
Researchers first saw Squirrelwaffle during malicious spam campaigns at the start of September 2021. The malware was identified as an email-delivered loader distributed through phishing links to ZIP archives containing weaponized Office documents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 72 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cynet.com
Open sourcemalware-traffic-analysis.net
Open source0ffset.net
Open source0ffset.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two malware loaders used to establish initial access and stage follow-on intrusions: **SquirrelWaffle**, which arrived through phishing documents and dropped VBS and PowerShell components before retrieving a packed 32-bit DLL, and **Bumblebee**, which was delivered through compromised open-source tools in an MSI installer containing a CAB archive. In the SquirrelWaffle chain, the DLL dropper unpacked shellcode using XOR/ROR logic and APLIB decompression, then loaded a payload exported as `ldr` that collected host data, decrypted embedded configuration, and extracted command-and-control IP addresses and domains. The malware communicated over standard `WS_32` socket APIs and downloaded **Cobalt Strike**, saving the binary with a `.txt` extension before execution. Analysis of Bumblebee showed a different but similarly stealthy execution path built around **DLL sideloading** and **DLL proxy forwarding**. The installer abused the legitimate Microsoft-signed `icardagt.exe` binary to load a malicious DLL that was renamed to `version.dll` at runtime, while anti-analysis features included junk code, timing checks, and possible virtual-machine detection through WMI queries. Investigators also observed failed file-creation attempts, a network connection to `19ak90ckxyjxc.life`, a temporary installation directory, and a Windows Installer `UserData` registry artifact, reinforcing that the MSI package orchestrated the full infection chain and positioned the malware for later hands-on-keyboard activity or ransomware deployment.
Jun 29, 2026
Attackers exploited unpatched on-premises Microsoft Exchange servers using **ProxyLogon** and **ProxyShell** flaws, including `CVE-2021-26855`, `CVE-2021-34473`, and `CVE-2021-34523`, to hijack legitimate email conversations and send phishing replies from real user accounts. Investigations found the activity on compromised Exchange servers in multiple intrusions, with attackers accessing mailbox data, impersonating users, and distributing links to ZIP archives containing malicious Word or Excel documents. In several cases, the emails were sent internally or from trusted accounts, helping the campaign bypass normal mail defenses; one investigation also identified attacker-created Outlook items marked with the unusual `IPM.Blabla` class. The phishing chain delivered **Squirrelwaffle**, a loader that used malicious Office files and Excel 4.0 macros to fetch DLL payloads, often executed with `regsvr32`, leading to follow-on infections including **QakBot**, **Cobalt Strike**, and fileless registry-based stagers with scheduled-task persistence. Researchers linked the campaign to compromised WordPress infrastructure, anti-analysis controls, and command-and-control traffic that exfiltrated obfuscated host data, while one incident escalated beyond malware delivery into attempted payment redirection through a typo-squatted domain in a business email compromise-style fraud scheme. Defenders were urged to patch Exchange comprehensively, hunt for post-exploitation artifacts such as web shells and malicious mailbox activity, and harden email authentication controls including **SPF**, **DKIM**, and **DMARC**.
Aug 14, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026