BelialDemon

BelialDemon is the threat actor associated with the development and advertising of Matanbuchus, a Malware-as-a-Service loader first promoted on Russian-speaking cybercrime forums in February 2021. The actor is linked to financially motivated cybercrime activity centered on providing loader capability for downstream intrusion operations. Matanbuchus has been marketed as a premium service and has been used to deliver additional payloads including Cobalt Strike, QakBot, DanaBot, Rhadamanthys stealer, NetSupport RAT, and a custom implant referred to as AstarionRAT. Activity attributed to BelialDemon has relied on social engineering and phishing-based initial access, including spearphishing attachments, HTML smuggling, malicious ZIP archives, deceptive MSI installers, and more recently ClickFix-style lures that induce victims to execute silent installer commands. A recurring tradecraft pattern is abuse of Microsoft Installer packages to masquerade as legitimate software, stage payloads in user-space directories, and execute malicious components through custom actions. Observed Matanbuchus delivery chains have used signed or deceptively branded installers, fake software-update themes, misleading installation errors, and asynchronous execution so malware continues running after the installer appears to fail. BelialDemon-linked tooling supports download-and-execute operations, arbitrary PowerShell execution, command-and-control communications over web protocols, persistence, and stealthy staging of follow-on malware. Delivery chains have used regsvr32-based execution, DLL sideloading, reflective loading, anti-debugging checks, encrypted configuration and strings, process enumeration for security-product discovery, and other defense-evasion measures. Later Matanbuchus variants have been described as a substantial rewrite with expanded operator functionality, including support for multiple payload formats, in-memory execution, reverse shell capability, and WQL execution. Intrusions involving Matanbuchus have also shown hands-on-keyboard post-compromise behavior consistent with pre-ransomware or data-theft operations, including lateral movement, rogue account creation, and security-control weakening. BelialDemon is best understood as a Russian-speaking cybercriminal actor operating in the malware-service ecosystem rather than a nation-state group. The actor's known public association is primarily with the Matanbuchus loader and its evolution.