BamboLoader
BamboLoader is a heavily obfuscated Windows shellcode loader used by the China-nexus activity cluster “Silver Dragon,” which Check Point assesses as operating within the broader APT41 umbrella. It has been observed in intrusions targeting primarily government entities in Europe and Southeast Asia since at least mid-2024.
BamboLoader is described as an x64 C++ loader employing control-flow flattening and junk code. In observed service-DLL and phishing infection chains, it functions as an in-memory loader: it reads a staged shellcode payload from disk, decrypts it using RC4 with a hardcoded key, decompresses the result using the LZNT1 algorithm (via RtlDecompressBuffer), and injects the decrypted shellcode into a legitimate Windows process (commonly taskhost.exe/taskhostw.exe; injection target is configurable). The ultimate payload delivered in these chains is a Cobalt Strike beacon (noted as cracked in the reporting).
Delivery/persistence contexts described include: (1) a “service DLL” chain where a batch script delivers BamboLoader and registers it as a Windows service / abuses legitimate Windows services for persistence via registry manipulation and service recreation to load a malicious ServiceDll; and (2) a phishing campaign using weaponized LNK attachments (noted in one case as Uzbekistan-focused) where the LNK launches PowerShell to extract embedded payloads, then uses a legitimate executable (GameHook.exe) for DLL sideloading of BamboLoader (as graphics-hook-filter64.dll) while displaying a decoy document; the encrypted Cobalt Strike payload in this chain was named simhei.dat.
Additional artifacts/paths mentioned in association with the service-DLL chain include writing the loader DLL to C:\Windows\System32\wbem and placing encrypted payloads disguised with .fon or .ttf extensions under C:\Windows\Fonts. Legitimate Windows services reported as abused for persistence include wuausrv, bthsrv, COMSysAppSrv, DfSvc, and tzsync.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A shellcode DLL loader we named BamboLoader... The loader reads the staged shellcode payload from disk, decrypts it using RC4 with a hardcoded key, and then decompresses the resulting data with the LZNT1 algorithm...
"...a phishing campaign with a malicious LNK file as an attachment, a tactic linked to Silver Dragon based on the use of similar loaders, which the researchers collectively call 'BamboLoader.'"
"...a phishing campaign with a malicious LNK file as an attachment, a tactic linked to Silver Dragon based on the use of similar loaders, which the researchers collectively call 'BamboLoader.'"
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
6 techniques
Execution
"...weaponized LNK file is designed to launch PowerShell code by means of 'cmd.exe'"
“Upon execution, the LNK file launches cmd.exe, which in turn invokes PowerShell.”
“…injected into a Windows process, such as taskhost.exe, which is created as a child process.”
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
"The group leverages heavily obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
"...decrypt and inject payloads in memory" ... "including ... injected processes."
"...obfuscated loaders such as MonikerLoader and BamboLoader to decrypt and inject payloads in memory"
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Heavily obfuscated loader used for in-memory decryption/injection and delivery of the final Cobalt Strike beacon payload.
Heavily obfuscated C++ shellcode DLL loader used to decrypt/decompress staged shellcode and inject it into a legitimate Windows process (e.g., taskhost.exe); also delivered via DLL sideloading in a phishing chain to ultimately launch Cobalt Strike.
A loader used in Silver Dragon phishing campaigns (notably via weaponized LNK attachments) to establish initial execution and facilitate delivery of follow-on tooling/payloads.
An obfuscated x64 C++ shellcode loader that establishes service-based persistence by hijacking legitimate Windows services, decrypts staged payloads (RC4) and decompresses them (LZNT1 via RtlDecompressBuffer), then injects the resulting shellcode into a spawned process (e.g., taskhostw.exe). Observed final payloads are Cobalt Strike beacons.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.