Loading malware…
BLISTER is a Windows malware loader first publicly identified in 2021 and associated with financially motivated intrusion activity. It is designed to conceal and execute embedded follow-on payloads while maintaining a low detection profile through extensive defense-evasion tradecraft. BLISTER has been observed in intrusion chains linked to SocGholish/FakeUpdates and in operations that progressed to Cobalt Strike, BitRAT, MYTHIC-based implants, and ultimately ransomware deployment including LockBit.
BLISTER commonly embeds malicious code inside otherwise legitimate signed or benign-looking executables or DLLs and has used valid code-signing certificates to reduce trust friction and antivirus scrutiny. It has been delivered through malicious installers and fake browser update chains, including drive-by activity associated with compromised websites and SocGholish infrastructure. Execution frequently relies on proxying through legitimate Windows binaries such as rundll32, and multiple reports describe BLISTER dropping or loading a malicious DLL that decodes shellcode or a PE payload from resources.
A defining characteristic of BLISTER is its layered anti-analysis and stealth functionality. Documented variants use delayed execution, dynamic API resolution, direct or indirect syscall-oriented techniques, process instrumentation unhooking, masquerading within legitimate libraries, and process hollowing or injection into legitimate processes such as WerFault or rundll32-hosted contexts. Newer variants introduced configurable anti-debug timing and environmental keying based on the victim machine's domain, allowing operators to restrict execution to intended targets and reduce exposure in sandboxes or researcher environments.
BLISTER has evolved over time. Early activity prominently delivered Cobalt Strike and occasionally BitRAT, while later campaigns increasingly deployed a likely custom MYTHIC agent and associated shellcode packers. Persistence has also been observed, including startup-folder based execution using copied legitimate binaries and malicious DLLs. In ransomware-oriented intrusions, BLISTER has served as a staging component preceding hands-on-keyboard activity such as disabling security tools, stopping services, modifying policy-related settings, clearing logs, and preparing the environment for final payload deployment.
The malware is best understood as a mature, actively developed loader used to establish covert execution of secondary payloads in targeted Windows environments, especially in financially motivated access and post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Blister is a piece of malware that loads a payload embedded inside it. We provide an overview of payloads dropped by the Blister loader based on 137 unpacked samples from the past one and a half years and take a look at recent activity of Blister.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Injection of the payload into a legitimate process such as werfault.exe
By the end of July, we observed campaigns involving a new BLISTER loader that targeted victim organizations to deploy the MYTHIC implant. MYTHIC running inside injected WerFault process
A new process is created with the above command line to spawn a Rundll32 process via CreateProcessW Win32 API.
The download zip file contained the malicious JavaScript Chrome.Update.1313a9.js, which masquerades as an update for the browser.
Injection of the payload into a legitimate process such as werfault.exe
By the end of July, we observed campaigns involving a new BLISTER loader that targeted victim organizations to deploy the MYTHIC implant. MYTHIC running inside injected WerFault process
At the end of the decoding stub, it either jumps or calls back and then invokes the decryption function. This decryption function uses RC4, but the S-Box is already initialized, thus no key-scheduling algorithm is implemented. Lastly, it jumps to the final payload.
Observed adversary tactics and techniques ... System Binary Proxy Execution: Rundll32
A recent addition to BLISTER is the capability to exclusively execute on designated machines... the malware proceeds to extract the machine's domain name using the GetComputerNameExW Windows API... the resulting hash is then compared to a hash present in the configuration.
This functionality is presumably deployed for the purpose of targeted attacks or for testing scenarios, ensuring that the malware refrains from infecting unintended systems such as those employed by malware researchers.
will create a thread that will essentially put itself to sleep for 10 minutes before decrypting and executing its shell code. It also pauses operations in order to evade detection
This functionality is presumably deployed for the purpose of targeted attacks or for testing scenarios, ensuring that the malware refrains from infecting unintended systems such as those employed by malware researchers.
Finally, it downloads and executes the Cobalt Strike beacon, which is used to execute remote commands.
Some of the beacons are configured to use “domain fronting”... Certain beacons have subdomains of fastly[.]net as their C2 server... However, the domains they connect to are admin.reddit[.]com or admin.wikihow[.]com, which are legitimate domains hosted on a CDN.
399 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Blister is referenced as a loader/backdoor observed as a downstream payload associated with SocGholish activity in 2024-2025.
With the release of v0.16, here are the different malware families that we cover. blister deprecated ghostpulse latrodectus lobshot lumma netwire redlinestealer remcos smokeloader stealc strelastealer xorddos
Referenced as a malware family whose DLL export patching technique resembles behavior seen in SADBRIDGE.
A malware loader that executes embedded payloads. The report says it has been used in targeted deployments, supports environmental keying via DNS search domain hashing, can enable persistence by copying itself and rundll32.exe to the Startup folder via IFileOperation, and has evolved to use a more obfuscated first-stage loader. Historically it dropped Cobalt Strike and more recently custom Mythic-related payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.