Loading malware…
OAED Loader is a Windows DLL malware loader used in targeted espionage intrusions associated with China-linked threat activity, including operations attributed to Tick (Bronze Butler) and Tonto Team. It is typically launched through DLL sideloading with a legitimate application and then decrypts and loads an embedded secondary payload. Observed payloads have included NKN-goRAT, ShadowPad, ABK downloader, Gokcpdoor-related components, and Havoc-associated implants, indicating that OAED Loader functions as a reusable delivery component rather than a single-purpose family.
Its core behavior is to unpack or decrypt an embedded payload and inject it into a legitimate process or executable according to embedded configuration, providing stealth and defense evasion. Reported execution chains show OAED Loader being used to covertly place final payloads into trusted Windows processes and legitimate executables, with DLL sideloading serving as the primary launch and concealment mechanism. This makes it effective as an intermediary stage between initial compromise and the final espionage implant.
OAED Loader has been observed in campaigns targeting Japanese organizations and in later activity affecting Russia. In one documented case it delivered NKN-goRAT, a Go-based remote access trojan that used the NKN decentralized networking protocol for command and control. Across campaigns, OAED Loader appears to be valued for flexible payload delivery, process injection, and operational stealth in post-compromise environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
China-linked cyber-espionage actors tracked as 'Bronze Butler' (Tick) exploited a Motex Lanscope Endpoint Manager vulnerability as a zero-day... The flaw exploited in these attacks is CVE-2025-61932, a critical request origin verification flaw impacting Motex Lanscope Endpoint Manager versions 9.4.7.2 and earlier. It enables unauthenticated attackers to execute arbitrary code on the target with SYSTEM privileges via specially crafted packets.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OAED Loaderは、DLL形式のマルウェアであり、ペイロードを内包しています。含まれるペイロードはさまざまで、今回のケースでは「NKN-goRAT」と呼ばれるRATが含まれていました。過去には、ShadowPadやABK downloaderといったマルウェアが含まれていたこともあります。
OAED Loaderは、DLL形式のマルウェアであり、ペイロードを内包しています。含まれるペイロードはさまざまで、今回のケースでは「NKN-goRAT」と呼ばれるRATが含まれていました。過去には、ShadowPadやABK downloaderといったマルウェアが含まれていたこともあります。
3 distinct techniques documented for this family, organized by ATT&CK tactic.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OAED Loader is a loader malware used to deliver final payloads and employs DLL side-loading for covert injection into legitimate executables.
Loader used to load the final payload and inject it into legitimate executables, leveraging DLL sideloading for evasion.
DLL loader used in the infection chain via DLL side-loading to inject payloads on compromised systems.
Loader/injector used to complicate execution flow by injecting a payload into a legitimate executable based on embedded configuration; used alongside Gokcpdoor and Havoc in this campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.