Loading story…
Olymp Loader has emerged as a new malware-as-a-service (MaaS) platform, rapidly gaining traction among low-tier cybercriminals due to its turnkey nature and advanced technical features. The service, first launched in June 2025 as a botnet tool, quickly pivoted to a loader-as-a-service model by August, enabling users to stealthily deliver additional malware payloads to compromised systems. Olymp Loader is fully written in assembly language, which contributes to its claims of being fully undetectable (FUD) by antivirus solutions, a feature heavily marketed by its operator known as 'OLYMPO.' The loader's undetectability is further supported by low detection rates on VirusTotal, as observed by security researchers from Outpost24. Frequent uploads of Olymp samples to VirusTotal, likely by OLYMPO and their clients, have allowed researchers to track the malware's rapid evolution and feature expansion. Early versions of Olymp Loader incorporated built-in stealer modules, including a Telegram stealer, browser stealer, and crypto stealer, broadening its appeal to threat actors seeking to harvest sensitive information. The browser stealer component is based on the open-source BrowserSnatch project, while the crypto stealer targets a wide range of cryptocurrency wallets such as Exodus, Electrum, Atomic, Guarda, Wasabi, Monero, BitcoinCore, and ZelCore. Olymp Loader supports the delivery of custom payloads across multiple formats, including 32-bit, 64-bit, .NET, Java, and native executables, with LummaC2 and WebRAT being the most commonly observed post-infection payloads. In late June, the service began offering personal builds with custom payloads embedded for an additional fee, and by late August, it introduced a crypter feature, which has become its most popular offering. The operator has announced plans to expand the service further, potentially bundling botnet, loader, crypter, installs service, and file-scanning tools into a comprehensive package. Olymp Loader is primarily advertised on underground forums such as HackForums and Telegram, where its official channel has attracted nearly a hundred subscribers. The pricing model has evolved alongside the feature set, with costs ranging from $40 to $200 per stub depending on customization and included features. The loader's accessibility, technical sophistication, and ongoing development make it a significant threat, particularly for organizations concerned about information theft and malware delivery. Security professionals are advised to monitor for Olymp Loader activity and implement robust endpoint protection measures to mitigate the risk posed by this rapidly evolving MaaS platform. The emergence of Olymp Loader underscores the increasing commoditization of sophisticated malware tools, lowering the barrier to entry for cybercriminals and amplifying the threat landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On September 30, 2025, reporting based on Outpost24 research publicly detailed Olymp Loader's emergence, technical evolution, and growing popularity among low-tier cybercriminals. The disclosure also noted one case where Olymp was delivered as a second-stage payload by Amadey.
As the service evolved in recent months, Outpost24 observed Olymp supporting multiple payload types and commonly delivering LummaC2 and WebRAT. The malware also used evasion methods including code-cave injection, XOR encryption, Defender exclusions, and code signing, and was disguised as legitimate software such as Node.js, PuTTY, OpenSSL, and Zoom.
By late August 2025, the operators had added a crypter feature and offered paid personal builds, reflecting rapid capability growth and commercialization. The service was also being advertised on HackForums and Telegram, with pricing increasing over time.
In August 2025, Olymp shifted into a loader-as-a-service offering designed to stealthily deliver additional malware payloads. Researchers noted it was written entirely in assembly language and marketed as fully undetectable by antivirus tools.
Outpost24 reported that Olymp first appeared in June 2025 as a botnet-focused malware service. Early samples uploaded to VirusTotal showed built-in stealer functions targeting Telegram, browsers, and cryptocurrency wallets.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple sophisticated malware campaigns have been identified targeting organizations and individuals across various regions, utilizing advanced loader techniques and evasion tactics. Notable threats include AuraStealer, a malware-as-a-service infostealer distributed via social media scams and cracked software, capable of stealing data from a wide range of browsers and applications, and employing anti-analysis features such as geolocation checks and virtual machine detection. CloudEyE, another malware-as-a-service downloader and cryptor, has seen a dramatic increase in detections, serving as a delivery mechanism for other malware like Rescoms, Formbook, and Agent Tesla, and leveraging multi-stage delivery tactics to avoid detection. Additionally, a commodity loader has been used in targeted email campaigns against manufacturing and government sectors, employing weaponized documents, steganography, and multi-layered evasion pipelines to distribute remote access trojans and infostealers. The Tuoni C2 malware framework was used in a stealthy attack against a major U.S. real estate firm, utilizing AI-generated code, steganography, and memory-only execution to evade detection and maintain long-term access for credential theft and potential ransomware deployment. These campaigns highlight a trend toward modular, evasive malware delivery systems that leverage commodity loaders, steganography, and malware-as-a-service models, enabling threat actors to efficiently compromise targets while minimizing forensic footprints. Security researchers emphasize the need for advanced detection and prevention strategies to counter these evolving threats, as traditional security layers are increasingly bypassed by modern malware techniques.
Jun 29, 2026
**OysterLoader** (aka **Broomstick** / **CleanUp**) is a C++ multi-stage loader/downloader that uses layered obfuscation and anti-analysis to evade detection and deliver follow-on payloads, and has been repeatedly tied to intrusion chains that culminate in **Rhysida ransomware**. The loader is primarily distributed via **fake websites impersonating legitimate software** (commonly IT/admin tools such as *PuTTy*, *WinSCP*, and *Google Authenticator*, as well as AI-themed tools), where victims are lured into downloading **malicious `MSI` installers** that are often **digitally signed** to appear trustworthy. Reporting attributes OysterLoader’s early public identification to Rapid7 (June 2024) and notes ongoing evolution in its codebase and tradecraft, including changes to obfuscation and command-and-control behavior. Technical analysis describes a **four-stage infection chain**: (1) a **TextShell** packer/obfuscator, (2) **custom shellcode** execution, (3) an intermediate **DLL downloader**, and (4) the **OysterLoader core**. Observed capabilities include **dynamic API resolution** (custom hashing), **API hammering**, and **timing-based sandbox detection**, alongside a **two-tier C2 architecture** separating initial delivery infrastructure from final C2 used for victim interaction. While primarily associated with Rhysida operations (with reporting also linking Rhysida to the **WIZARD SPIDER** ecosystem), OysterLoader has also been observed delivering **commodity malware** such as **Vidar** infostealer; additional reporting indicates it can be distributed via **Gootloader**, and it remains unclear whether OysterLoader is proprietary to a specific actor set or offered more broadly (e.g., as a private MaaS-style capability).
Jun 29, 2026
Researchers linked **PrivateLoader** to a long-running pay-per-install malware ecosystem that used SEO-poisoned sites and cracked-software lures to infect Windows users with password-protected ZIP archives and NSIS installers. The loader was repeatedly observed delivering a wide range of payloads, including **RedLine**, **Vidar**, **SmokeLoader**, **RisePro**, **Qbot**, **Dridex**, **DanaBot**, **TrickBot**, **Kronos**, **LockBit**, **STOP Djvu**, and **Conti**, while related tooling such as **Discoloader** and the Go-based **Anubis Loader** expanded the same distribution chain. Investigations described administration panels used to manage payload links, browser extensions, bot installs, and operator activity, with one panel reportedly overseeing about **20,000 bots** and collecting more than **11 GB** of stealer logs in less than two weeks. Separate reporting showed PrivateLoader also acting as an access broker for other criminal and state-linked operations. Analysts observed it distributing **ColibriLoader** in a campaign tied to **UAC-0113**, a group CERT-UA has associated with **Sandworm**, and later delivering **Socks5Systemz**, a proxy botnet that converted infected Windows hosts into rentable proxies. Bitsight estimated Socks5Systemz had about **10,000 infected systems** and at least **53 servers** supporting command-and-control, telemetry, DNS, and backconnect functions, with customers buying proxy access through a Telegram-linked service for cryptocurrency. Across the reporting, PrivateLoader emerged as a versatile initial-access platform connecting commodity stealers, banking trojans, ransomware, proxy monetization, and higher-end intrusion activity.
Aug 15, 2026