Loading story…
Researchers have identified CountLoader, a new malware loader used by Russian ransomware groups to deliver tools like Cobalt Strike and PureHVNC RAT. The loader is distributed via phishing campaigns, particularly targeting Ukraine, and leverages multiple file types and living-off-the-land binaries for persistence and execution. CountLoader's infrastructure supports major ransomware affiliates and demonstrates advanced malware development techniques.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new malware campaign has been identified in which threat actors are distributing the GachiLoader and CountLoader malware through YouTube video links and cracked software distribution sites. Users are lured into clicking on malicious links embedded in YouTube videos or downloading pirated software, which initiates a multi-stage infection process. The campaign leverages social engineering and popular platforms to maximize reach and evade traditional detection methods. Technical analysis reveals that the attack chain often begins with a ZIP archive containing a renamed Python interpreter, which executes malicious commands to retrieve CountLoader 3.2 using `mshta.exe`. The malware establishes persistence by creating scheduled tasks that mimic legitimate Google processes and adapts its behavior if security tools like CrowdStrike Falcon are detected. CountLoader is capable of delivering additional payloads such as Cobalt Strike, PureHVNC RAT, and Amatera Stealer, and the latest variants include features for host profiling and propagation via removable media.
Jun 29, 2026
Breakglass Intelligence reported that the **CountLoader** malware campaign used polyglot HTA files disguised as benign formats including `.wav`, `.xml`, `.mp4`, `.ini`, and `.csv` to trigger execution through `mshta.exe` on Windows. The loader combined layered obfuscation, sandbox and CrowdStrike Falcon-specific evasion, scheduled-task persistence, multiple payload download fallbacks, and a USB LNK worm capability. Its theft focus was unusually broad, targeting **76 cryptocurrency wallet browser extensions**, **6 desktop wallet applications**, and data from **66 Chromium-based browsers**, while also retaining Active Directory reconnaissance modules that could support later enterprise compromise and ransomware activity. Researchers said the operator rapidly evolved the campaign over several days, publishing **28 new samples** to MalwareBazaar, rotating **three of four** known C2 IPs, adding new C2 domains and a tracking beacon, and simplifying the protocol in CountLoader `v4.1.1` by removing a UTF-16LE layer while still exposing the XOR key in plaintext. Despite the churn, stable fingerprints such as a constant CLSID and unchanged wallet-stealing and reconnaissance modules persisted. The infrastructure used domains registered through NiceNIC, separate Cloudflare accounts and nameserver pairs for compartmentalization, and backend hosting across multiple providers, with earlier analysis tying five active C2 domains and one related domain to a single AlexHost IP in Moldova. Breakglass assessed the actor as a likely **Russian-speaking cybercrime or MaaS operator** with strong infrastructure management but only moderate payload-development sophistication.
Jun 29, 2026
Researchers reported renewed activity involving **Matanbuchus**, a **malware-as-a-service** loader sold on Russian-speaking cybercrime forums, where it has been advertised for rent at roughly **$2,500**. In observed campaigns, attackers used phishing emails carrying ZIP attachments that led victims through a multistage infection chain: an HTML file dropped another ZIP archive containing an MSI installer, which wrote a DLL and VBS file to disk and invoked `regsvr32.exe` to execute the malicious DLL. The loader then performed anti-analysis checks, created persistence through a scheduled task, and contacted command-and-control infrastructure to retrieve its next-stage payload directly in memory. Technical analyses showed that Matanbuchus uses obfuscated and encrypted strings, API hashing based on **FNV1a**, and HTTP communications to download follow-on malware while minimizing disk artifacts. Researchers linked the loader to deployments of **Cobalt Strike Beacons** and noted overlap with phishing operations involving other malware such as **Qakbot**. Reverse-engineering work also identified multiple infrastructure domains, sample hashes, and distinct loader and payload components, while updated **YARA** rules and configuration extractors improved detection of newer variants.
Aug 15, 2026