MalwareRansomwareUsed by 1 actor

PowerLoader

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Fluffy Wolf

PowerLoader is an undocumented C++ downloader that executes almost entirely filelessly to bypass standard endpoint defenses like Windows Defender.

via security online infosecurityonline.info

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence1

Security researchers have uncovered a series of highly sophisticated Fluffy Wolf phishing attacks targeting Russian organizations across various critical sectors.

T1566.001Spearphishing AttachmentEvidence2

Using highly deceptive tactics, the attackers send emails masquerading as legitimate corporate communications regarding outstanding debts, reconciliation statements, or legal claims. To bypass modern email security gateways, the attackers heavily rely on malicious RAR attachments...

T1566.002Spearphishing LinkEvidence2

Fluffy Wolf uses GitHub repository URLs in phishing emails. Because such links appear legitimate, they help the attackers bypass email filtering and network security controls while increasing the likelihood that recipients will open them.

Execution

1 technique

T1059.001PowerShellEvidence2

Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Once PowerLoader infiltrates a target host, it spawns hidden PowerShell instances to retrieve additional malicious scripts directly from the command-and-control (C2) server. These scripts systematically deploy the final payloads...

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

security online infoNews

Jun 16, 2026

Fluffy Wolf Phishing Attacks Push PowerLoader Malware

A Malware-as-a-Service C++ downloader used by Fluffy Wolf that operates largely filelessly, spawns hidden PowerShell to fetch scripts from C2, and deploys final payloads including Pay2Key, PureLogs, and PureRAT.

xakepNews

May 28, 2026

Группировка Fluffy Wolf атаковала российские компании новой малварью - Хакер

Новый загрузчик на C++, запускающий PowerShell в скрытом режиме и получающий скрипты с управляющего сервера; затем скачивает и запускает PureCrypter.

malwaretech blogNews

Aug 13, 2013

PowerLoader Injection – Something truly amazing

PowerLoader is a malware loader known for its advanced process injection techniques, specifically using ROP chains to inject code into trusted processes like explorer.exe while evading detection by antivirus solutions. It avoids common telltale signs of injection (such as allocating heap space or creating threads) by leveraging shared memory sections and executing code via manipulation of window procedures and ROP chains, ultimately achieving shellcode execution without triggering Data Execution Prevention (DEP).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.