Loading malware…
HeaconLoad is a Golang malware family used as a downloader in financially motivated malware distribution campaigns centered on fake software and game-cheat lures hosted through brand-impersonation and SEO-poisoned GitHub repositories. It has been observed as part of multi-stage Windows infection chains that also deliver information stealers such as BoryptGrab and Vidar variants, as well as additional backdoor payloads.
HeaconLoad is used to retrieve and execute follow-on malware after initial user execution of a trojanized package. Reported delivery chains include ZIP archives masquerading as legitimate tools, utilities, or cracked software, with execution sometimes initiated through DLL side-loading or intermediary script and loader components. Some campaigns bundled HeaconLoad directly, while others used earlier-stage launchers to fetch it.
On infected systems, HeaconLoad has been reported to collect basic system information, contact command-and-control infrastructure, and download additional payload bundles when instructed. It has also been associated with persistence through scheduled tasks and registry-based autorun mechanisms. In the observed campaigns, operators used layered obfuscation and loader logic, including encrypted strings, dynamic API resolution, and code-injection-related techniques elsewhere in the infection chain, to complicate analysis and payload delivery.
HeaconLoad has been linked to opportunistic, financially motivated operations that abuse user trust in popular software brands and public code-hosting platforms rather than exploiting a specific software vulnerability. Available reporting suggests Russian-language development or operational artifacts in the broader campaigns, but public attribution to a specific named threat actor remains unconfirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Golang loader referenced as a secondary payload in prior BoryptGrab reporting, not the main malware analyzed here.
Golang-based downloader/loader used to fetch and execute additional payloads in the campaign.
Golang downloader/loader used as an additional payload; maintains persistence via registry entries and scheduled tasks, sends system info to C2, and downloads additional bundles/payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.