Lure Marauder

Storm-0494, also tracked as UNC2565 and referred to here as Lure Marauder, is a malware delivery and intrusion cluster associated with Gootloader-style initial access operations and closely linked to the Rapid Brigantine ecosystem. The actor has used compromised WordPress infrastructure to present fake browser security update lures, including ClickFix-style social engineering that instructs victims to paste malicious commands into Windows Terminal. This delivery approach represents a shift from earlier use of fraudulently signed installers and demonstrates an ability to rapidly adapt infection chains when upstream enablers are disrupted. Observed tradecraft includes staged payload delivery through PowerShell and Node.js, hidden execution, execution-policy bypass, anti-debugging checks, sandbox evasion through extended sleep intervals, custom payload encoding and reconstruction, persistence via Run-key modification, and DLL sideloading to launch malicious components through legitimate binaries. In the documented infection chain, a Node.js-based dropper reconstructs multiple components from encoded data and deploys a malicious sideloaded DLL that launches the Lorem Ipsum Loader. The Lorem Ipsum Loader has been used to resolve next-stage command-and-control through attacker-controlled profiles on public platforms using dead-drop resolver techniques. Operational continuity with Rapid Brigantine is supported by shared tooling patterns, dead-drop C2 logic, DLL sideloading behavior, per-victim tracking, and overlap with publicly reported post-exploitation tooling including Oyster, Supper, and MeowBackConn, with some intrusions reportedly culminating in Rhysida ransomware deployment. Taken together, Storm-0494/UNC2565 appears to function primarily as an access and malware delivery element within a broader cybercriminal intrusion ecosystem oriented toward follow-on post-exploitation and ransomware activity.