Loading malware…
KrustyLoader is a Rust-based first-stage malware loader associated primarily with China-nexus intrusion activity, especially operations linked to UNC5221, also tracked as UTA0178 and in some reporting as QuietCrabs. It has been observed after exploitation of internet-facing enterprise and edge systems including Ivanti Connect Secure, Ivanti Endpoint Manager Mobile, SAP NetWeaver, and SharePoint environments. Its core role is to retrieve, decrypt, and execute a second-stage payload, most commonly the Sliver post-exploitation framework or backdoor.
KrustyLoader has been documented on both Linux and Windows during different intrusion sets. On Linux, it has been analyzed as a stripped Rust ELF binary that performs multiple execution-environment checks before proceeding, including self-path inspection, parent-process validation, anti-debugging logic, and self-deletion. It decrypts an embedded staging location, downloads an encrypted payload, decrypts that payload with AES-128-CFB, writes or launches the result, and executes the second stage. Reporting also describes variants or deployments that inject the decrypted Sliver payload into memory. Obfuscation techniques include encrypted strings and embedded cryptographic material used to conceal staging information.
Operationally, KrustyLoader functions as an initial-stage delivery component in broader espionage-oriented compromises. It has been deployed via web shells, JSP loaders, and direct command execution following exploitation of public-facing vulnerabilities. In observed campaigns, operators used it alongside tooling for persistence, credential access, reconnaissance, proxying, and lateral movement. Victimology spans government, telecommunications, healthcare, finance, universities, and other globally distributed organizations, with activity reported across the Middle East, Africa, South America, North America, Europe, and Asia.
KrustyLoader is notable less for standalone functionality than for its consistent role in post-exploitation chains used by sophisticated operators targeting edge infrastructure and enterprise applications. Its repeated use across multiple campaigns and vulnerability clusters makes it a useful malware marker for tracking UNC5221-linked and overlapping Chinese espionage activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
On 10th January 2024, Ivanti disclosed two zero-day critical vulnerabilities affecting Connect Secure VPN product: CVE-2024-21887 and CVE-2023-46805 allowing unauthenticated remote code execution. Volexity and Mandiant published several articles showing how these vulnerabilities were actively exploited by a threat actor... | They share almost 100% code similarity and their main purpose is to download and execute a Sliver backdoor. I personally labelled this piece of malware as KrustyLoader.
On 10th January 2024, Ivanti disclosed two zero-day critical vulnerabilities affecting Connect Secure VPN product: CVE-2024-21887 and CVE-2023-46805 allowing unauthenticated remote code execution. Volexity and Mandiant published several articles showing how these vulnerabilities were actively exploited by a threat actor... | They share almost 100% code similarity and their main purpose is to download and execute a Sliver backdoor. I personally labelled this piece of malware as KrustyLoader.
On July 25, KrustyLoader was dropped by the attackers. KrustyLoader was first documented in January 2024. It is an initial-stage malware, written in Rust, which has the primary purpose of delivering a second-stage payload.
“EclecticIQ analysts observed the execution of KrustyLoader malware within compromised Ivanti EPMM systems… Once installed, KrustyLoader retrieves a second-stage payload — an AES-128-CFB encrypted version of the Sliver backdoor.” | On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These vulnerabilities can be chained to achieve unauthenticated remote code execution (RCE) on exposed systems.
On Thursday, May 15, 2025, Ivanti disclosed two critical vulnerabilities - CVE-2025-4427 and CVE-2025-4428 - affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These vulnerabilities can be chained to achieve unauthenticated remote code execution (RCE) on exposed systems. | “EclecticIQ analysts observed the execution of KrustyLoader malware within compromised Ivanti EPMM systems… Once installed, KrustyLoader retrieves a second-stage payload — an AES-128-CFB encrypted version of the Sliver backdoor.”
UNC5221 was seen abusing a webshell to execute remote commands and fetch from an AWS S3 infrastructure the Rust-based malware loader KrustyLoader, which is typically used for dropping Sliver backdoors.
UNC5221 was seen abusing a webshell to execute remote commands and fetch from an AWS S3 infrastructure the Rust-based malware loader KrustyLoader, which is typically used for dropping Sliver backdoors.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They share almost 100% code similarity and their main purpose is to download and execute a Sliver backdoor. I personally labelled this piece of malware as KrustyLoader.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
China-based attackers used the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East shortly after the vulnerability was publicly revealed and patched in July 2025... In these attacks, the attackers used other vulnerabilities for initial access and exploited SQL servers and Apache HTTP servers running the Adobe ColdFusion software to deliver their malware.
It makes the random file executable using system command chmod +x /tmp/randomfile .
“Threat actors use HTTP GET requests, containing Java-based commands… designed to execute external malicious processes… spawning a reverse shell… using /bin/bash”
As a general point, there is a bit of obfuscation: most symbols are XOR-encrypted stack strings. The process of decryption used by the malware to retrieve the URL has three steps... XOR each byte with a 1-byte key; And uses AES-128 CFB-1 mode with hardcoded key and initialization vector to decrypt and get the URL.
“injects it directly into memory as shellcode… The resulting payload is loaded directly into memory and executed as shellcode”
KrustyLoader... can make a copy of itself and set itself up to self-delete when its activity is finished...
The malware reads /proc/self/exe to gets its path ( readlink ) and deletes itself ( unlink )
“embedded URL… hex string, then XOR encrypted (key: 0x49), and finally encrypted using AES-128 in CFB mode… decrypts… and injects it directly into memory”
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
KrustyLoader... can carry out various anti-sandbox and anti-analysis checks...
Then the following checks must be validated else the program exits: It gets the process parent ID (PPID) using getppid syscall and exits if PPID is 1... It checks the existence of /tmp/0 and exits if it does not. It checks if its executable (pointed by /proc/self/exe ) is located in /tmp/ directory. If it's not in /tmp/ directory, it exits.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
KrustyLoader is a loader malware used to download and execute additional payloads, such as the Sliver implant, after initial access.
Backdoor/loader deployed against edge networking devices by the QuietCrabs cluster.
KrustyLoader is a loader malware associated with the QuietCrabs threat actor, used to deploy additional payloads and facilitate further compromise. It has been observed in both Linux and Windows environments.
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.