Loading story…
Researchers linked Batloader activity to the Water Minyades / DEV-0569 / SteelClover ecosystem, which used malvertising, SEO poisoning, and fake software download pages to lure victims into installing trojanized packages. The campaigns abused legitimate installer frameworks such as Advanced Installer and WiX, then shifted to obfuscated JavaScript and PyArmor-protected Python loaders that fingerprinted hosts, contacted command-and-control infrastructure, escalated privileges, and attempted to disable security tools. Operators also used cloned software sites and malicious Google ads to distribute MSI files that launched PowerShell, added Microsoft Defender exclusions, and retrieved encrypted follow-on payloads.
The infections were used to selectively deploy a broad set of malware, including Qakbot, Ursnif, Vidar, ZLoader, RedLine Stealer, Raccoon Stealer, Cobalt Strike, and remote-management tools such as Atera and Syncro. Trend Micro reported that Batloader infections observed from September 2022 onward were associated with Royal ransomware, while NTT documented a surge of related infections at Japanese companies in early 2023 through the FakeGPG and BatApp campaigns. The activity was concentrated heavily in the United States but also affected Canada, Germany, Japan, and the United Kingdom, underscoring Batloader's role as a flexible initial-access platform for both credential theft and ransomware intrusion chains.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
Seqrite published an analysis of a BATLOADER 2.x infection chain in which a cabinet archive posing as cracked software led to a multi-stage batch and PowerShell loader that dropped AsyncRat. The report also disclosed technical details including AMSI and ETW bypasses, persistence methods, C2 fallback to jzx100.myddns.me, and file-hash IOCs.
In June 2023, Trend Micro observed Water Minyades upgrading Batloader campaigns by using Pyarmor Pro to obfuscate core malicious Python scripts. The report detailed an oversized MSI-based infection chain that installed WinRAR, unpacked Pyarmor-protected payloads, fingerprinted victims, and communicated with countingstatistic[.]com before delivering second-stage malware.
In mid-February 2023, eSentire said a manufacturing customer clicked a malicious Google Search ad for Adobe Reader, downloaded a fake Adobe MSI from a typo-squatted domain, and triggered BatLoader activity that attempted to deploy an Ursnif isfb_v2.14+ payload. The report disclosed that the BatLoader sample used embedded batch and PyArmor-protected Python scripts, disabled parts of Microsoft Defender, decrypted a payload from shvarcnegerhistory[.]com, and executed it via WorkFolders.exe before eSentire blocked the activity.
As of early February 2023, NTT Security Japan was observing the BatApp and FakeGPG campaigns associated with SteelClover. The report said SteelClover overlaps with DEV-0569 and Water Minyades and uses Batloader-related tradecraft.
NTT Security Japan reported a sharp increase in incidents at multiple Japanese companies beginning in early January 2023, driven by malware downloads initiated through malicious Google ads. The activity was attributed to the group it tracks as SteelClover.
In December 2022, Water Minyades used JavaScript instead of MSI files as the first-stage Batloader payload and later obfuscated the JavaScript downloader. This represented a delivery-chain change from earlier MSI-heavy campaigns.
Trend Micro said Batloader attack volume peaked from November through the first week of December 2022. The period fell within the broader Q4 2022 campaigns the company analyzed.
In October 2022, Water Minyades abused Google Ads and the Keitaro Traffic Direction System to redirect victims to Batloader downloads. This marked a notable expansion of the group's malvertising infrastructure.
Trend Micro observed Batloader MSI packages abusing Advanced Installer software between September and December 2022. These MSI-based campaigns used malicious custom actions as part of the infection chain.
Trend Micro observed that from September 2022, initial Batloader infections were leading to Cobalt Strike deployments and Royal ransomware infections. The report characterized Batloader as a key enabler for Royal ransomware.
eSentire reported BatLoader infections in September 2022 across consumer services, retail, telecommunications, and non-profit organizations, and a second campaign in October-November 2022 affecting insurance, consulting, healthcare, and printing. The analysis disclosed distinct signed MSI lures, campaign-specific C2 domains, host-profiling logic, Defender tampering, and payload delivery including Ursnif/ISFB, Vidar, Cobalt Strike, and Syncro RMM.
VMware Carbon Black MDR reported observing BatLoader campaigns as early as July 2022, describing them as prevalent across customer environments, especially in business and financial services. The campaigns used SEO poisoning and trojanized MSI installers posing as software like Zoom, TeamViewer, and AnyDesk to deliver follow-on payloads including Ursnif/Gozi, Arkei/Vidar, and sometimes a Cobalt Strike stager.
In February 2022, Water Minyades distributed Batloader via SEO poisoning. Trend Micro also said the actor used PE polyglotting to execute signed DLL files with appended malicious scripts.
In October 2020, Water Minyades moved from exploit kits to social-engineering campaigns using malicious ads on porn websites. Those campaigns delivered fake Java MSI files that deployed ZLoader.
In the second half of 2020, Water Minyades relied heavily on SmokeLoader and exploit kits including Rig and Fallout. This reflects an earlier delivery phase before the group's later Batloader-focused operations.
Trend Micro reported that the intrusion set it tracks as Water Minyades had activity dating back to early 2020. This establishes the earliest known timeframe for the actor later associated with Batloader.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
seqrite.com
Open sourcetrendmicro.com
Open sourceesentire.com
Open sourceesentire.com
Open sourceinsight-jp.nttsecurity.com
Open sourcetrendmicro.com
Open sourceblogs.vmware.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026
Researchers tied **ResolverRAT**, **LummaStealer**, and an **Amadey** botnet cluster to an active financially motivated campaign that has operated since at least late 2025 and uses fake browser update lures, staged loaders, and legitimate remote management tools for persistence. One analyzed chain used a Donut-decrypted, triple-protected `.NET` loader to deliver both ResolverRAT and LummaStealer at once, combining persistent remote access with credential and cryptocurrency wallet theft. The malware used layered obfuscation including .NET Reactor, custom transformations, AES-256-CBC, GZip, process hollowing, fragmented WinAPI reconstruction, forged compile timestamps, encrypted resource blobs, and certificate pinning, while operators rotated infrastructure across dozens of IPs, multiple domains, and hosting providers in Russia, the Netherlands, Germany, Poland, and elsewhere. Investigators also identified a fake Microsoft-themed domain, **pat[.]microsoft-telemetry[.]at**, and newly activated infrastructure such as **kampf[.]huehnchenfarm[.]ru** tied to the same ecosystem. A parallel March 2026 investigation linked the **fbf543** Amadey campaign to more than 50 payloads spanning at least 13 malware families, including Vidar, QuasarRAT, XWorm, AsyncRAT, Smoke Loader, and LummaStealer, with delivery through fake installers and hosting on infrastructure centered on **Omegatech LTD (AS202412)** and related abusive networks. Analysts found that the operators also abused nine legitimate, signed RMM tools from **ConnectWise, DattoRMM, Atera, GoToResolve, and N-able**, configuring them to beacon to attacker-controlled relays rather than compromising the vendors themselves. A separate Go-based loader unpacked LummaStealer with AES, RC4, and QuickLZ before hollowing **AppLaunch.exe**, reinforcing a playbook built around stealthy loaders, infostealer deployment, redundant access channels, and monetization consistent with an initial access broker or ransomware affiliate operation.
Jun 29, 2026