Loading story…
Researchers identified Sauron Loader, a previously undocumented C++ malware loader used as the final payload stage in multiple attacks on organizations in Germany. Marketed by the alias S4ur0n as a malware-as-a-service offering on Russian-speaking underground forums, it claims to prohibit attacks against CIS countries and public-sector entities. Observed intrusions began with ClickFix lures or vishing, including email-bombing victims before attackers called while impersonating IT support staff.
Sauron Loader establishes persistence with a scheduled task, uses DLL side-loading and in-memory decryption to reduce detection, and communicates with command-and-control infrastructure over HTTPS protected by custom Salsa20 encryption and RSA signatures. It can download and execute additional payloads, run commands, install drivers, inject shellcode, and capture and exfiltrate screenshots—capabilities that could support ransomware deployment, including operations associated with groups such as Qilin. Organizations should harden help-desk identity-verification processes, train staff against ClickFix and support-call social engineering, monitor scheduled-task creation and DLL side-loading, and investigate unusual HTTPS traffic and screenshot-collection behavior.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
DCSO analyzed an MSI-delivered Sauron Loader sample that used DLL side-loading through legitimate rnpkeys.exe, in-memory code decryption, and a scheduled task named “keyroll” for persistence. The analysis identified encrypted HTTPS C2 communications, broad payload-execution support, and screenshot collection and exfiltration capabilities.
DCSO observed Sauron Loader as the final-stage payload in multiple attacks against German organizations. The campaigns used ClickFix and vishing initial-access methods, including email bombing and IT-support impersonation.
An actor using the alias “S4ur0n” advertised Sauron Loader as a malware-as-a-service offering for Russian-speaking cybercriminals, claiming restrictions against targeting public-sector organizations and post-Soviet states.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Matanbuchus 3.0, a premium malware-as-a-service loader attributed to developer **BelialDemon**, is being used in social-engineering intrusions that begin with ClickFix prompts or Microsoft Teams vishing and Quick Assist abuse. In one investigated operation, a victim was induced to run a malicious MSI that deployed the loader through DLL sideloading; the infection chain ultimately installed the previously undocumented **AstarionRAT**. Operators then moved rapidly toward Windows servers and domain controllers using PsExec, created rogue accounts, and staged Microsoft Defender exclusions—activity consistent with preparation for ransomware deployment or data theft. The C++ rewrite replaces older Matanbuchus mechanisms with encrypted Protobuf command-and-control over HTTP(S), ChaCha20-protected strings and shellcode, dynamic Windows API resolution, and extensive security-product discovery. Its two-module architecture uses anti-analysis delays, junk code, a Heaven’s Gate transition to evade WoW64 EDR hooks, and multiple DLL-sideloading stages; it can establish persistence through the `Update Tracker Task` scheduled task and execute payloads from disk or memory. Organizations should prioritize user resistance to ClickFix and remote-support impersonation, restrict and monitor Quick Assist and PsExec, investigate suspicious MSI and DLL-sideloading activity, and alert on Defender exclusion changes, anomalous scheduled tasks, and unauthorized domain-account creation.
Sep 20, 2026
Researchers exposed an active **LegionLoader** malware campaign, also tracked as **Satacom**, **CurlyGate**, and **RobotDropper**, that uses drive-by-download lures and short-lived redirect pages to push password-protected archives from file-sharing services such as **Mega**. The archives contain MSI installers that unpack and sideload a malicious `obs.dll`, which decrypts shellcode and a second-stage executable before using **process hollowing** into `explorer.exe` to continue execution. Analysis found heavy use of `.monster` domains, hard-coded command-and-control infrastructure, and tooling intended to download additional payloads, although some observed C2 servers were inactive during review. The activity aligns with earlier Satacom operations that abused malicious or compromised websites and fake download buttons to distribute malware disguised as free or cracked software. In prior campaigns, the loader fetched follow-on payloads through DNS TXT lookups and PowerShell, then installed a fake Chromium-based **"Google Drive"** extension that targeted cryptocurrency users by stealing wallet data, manipulating transactions, bypassing 2FA, and suppressing transaction emails across Gmail, Hotmail, and Yahoo. The newer findings indicate the operators continue to rely on staged delivery, stealthy execution, and flexible payload retrieval, while defenders have been provided with hashes, URLs, file paths, registry artifacts, and **YARA** rules to detect the campaign.
Aug 15, 2026
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Aug 11, 2026