Loading story…
Buer Loader emerged as a commercially sold malware downloader that operators used to compromise Windows systems and deliver follow-on payloads including TrickBot, Cobalt Strike, KPOT, Amadey, Smoke Loader, and activity linked to Ryuk ransomware. Researchers reported that it was marketed on underground forums as an off-the-shelf service with setup support and updates, then spread through multiple infection chains including macro-enabled Word documents, malvertising, exploit kits, Ostap-based email campaigns, and later spam waves themed around DHL shipping and COVID-19 lures. Trend Micro also documented signed XLL files used as a delivery mechanism, including samples signed with a Sectigo-issued certificate that was later revoked.
The malware later evolved from a C-based loader into a Rust-based variant often called RustyBuer, while keeping compatibility with existing command-and-control infrastructure and operator panels. Analyses described layered anti-analysis and evasion features including geofencing to avoid CIS countries, debugger and sandbox checks, virtualization detection, long or CPU-intensive delays, decoy Windows API calls, API hashing, encrypted HTTPS tasking, and persistence through RunOnce or LNK methods. Researchers were still able to extract second-stage payloads from 2021 samples by recovering embedded keys and decrypting and decompressing protected data, showing that Buer remained under active development even as its core role as a first-stage malware delivery platform stayed the same.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
18 events from the most recent confirmed update back to the earliest known activity.
TEHTRIS analyzed Rust-based Buer Loader samples observed between July and August 2021. The samples used a Rust stage1 loader to decrypt and load a Rust stage2 payload in memory.
In July 2021, Trend Micro observed Buer Loader being delivered through a signed XLL file. The XLLs were signed with Sectigo OV code-signing certificates, including one tied to khorum[.]ru that was later revoked by Sectigo.
In May 2021, Walmart Global Tech published analysis of updated Buer Loader capabilities, including a DomainInfo module that profiles infected hosts and joined networks and posts the results to Buer command-and-control infrastructure. The report also described Buer's ability to load shellcode tasks directly, enabling delivery of Cobalt Strike without a separate stager, and noted panel features supporting spam operations.
An April 2021 spam campaign masquerading as DHL shipping notices distributed a new Rust-written variant of Buer Loader. The campaign used malicious Word or Excel attachments, including lures that combined DHL branding with COVID-19 themes.
Trend Micro reported that a newer Buer Loader variant rewritten in Rust, known as RustyBuer, was observed in the second quarter of 2021.
Trend Micro reported that Buer delivery moved away from Google Docs and began using Constant Contact in October 2020.
By September 2020, Trend Micro reported that Buer Loader had gained popularity as an alternative to Emotet for distributing Ryuk-associated payloads.
On October 21, 2019, Proofpoint observed malicious emails with subjects such as "Penalty Notice # PKJWVBP" carrying macro-enabled Word documents that executed Ostap. Ostap downloaded Buer, which then loaded a The Trick variant known as ono22.
On October 10, 2019, Proofpoint observed a malvertising campaign in Australia redirecting victims to the Fallout Exploit Kit, which dropped Buer. Buer then delivered KPOT stealer, Amadey, and Smoke Loader as second-stage payloads.
Proofpoint observed additional campaigns in September and October 2019 from the same actor delivering either Dreambot Ursnif or the new Buer loader.
On August 28, 2019, Proofpoint observed a malicious reply-chain email campaign using macro-enabled Word documents to download an undocumented loader later linked to Buer. The downloaded payloads were named verinstere222.xls or verinstere33.exe.
Proofpoint linked Buer activity to an underground forum advertisement posted on August 16, 2019. The loader was marketed for $400 with setup assistance, free updates and bug fixes, and extra fees for rebuilding to new addresses.
Proofpoint reported that it had tracked Buer since late August 2019 as a new modular first-stage downloader emerging in criminal delivery chains.
Malpedia published an autogenerated YARA rule named win_buer_auto for detecting the win.buer malware family. The rule metadata attributes authorship to Felix Bilstein, notes yara-signator as the generation tool, and sets matching conditions including a file size limit and sequence-based detection logic.
TEHTRIS published analysis of a Rust-based Buer Loader strain and described methods to extract its embedded stage2 payload from samples observed in mid-2021.
Trend Micro published a review of 2021 Buer Loader campaigns, highlighting Rust-based spam operations, COVID-19-themed lures, and signed XLL delivery techniques.
Proofpoint documented a new Buer Loader variant written in Rust in 2021, marking a significant rewrite from the earlier C-based implementation while preserving core loader behavior.
Proofpoint publicly analyzed Buer in December 2019, describing it as a modular loader sold on underground forums and used across email and exploit-kit delivery chains.
8 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourcetehtris.com
Open sourcetrendmicro.com
Open sourcemedium.com
Open sourceproofpoint.com
Open sourceproofpoint.com
Open sourcetrendmicro.com
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that attackers used the **Buer** malware-as-a-service loader to gain initial access in a Ryuk ransomware intrusion, highlighting a shift in how Ryuk affiliates were reaching victims. The intrusion began with a low-volume spear-phishing campaign that used malicious documents hosted on **Google Docs**, and Buer was then used to deploy a **Cobalt Strike** beacon that enabled lateral movement before **Ryuk** ransomware was launched across the network. The report said the activity later expanded into broader spam campaigns that also delivered other loaders, including **Bazar** and **ZLoader**, suggesting overlapping delivery infrastructure and coordinated lures. Sophos described Buer as a commercial loader for Windows that supports campaign management, victim filtering, and command-and-control tasking, and noted that observed samples used a stolen **DigiCert** code-signing certificate along with anti-analysis features and checks designed to avoid infecting systems in CIS-region countries.
Aug 14, 2026
Researchers detailed how **BazarLoader** evolved as an enterprise-focused malware loader tied to the TrickBot ecosystem, using the decentralized `.bazar` namespace on EmerDNS/OpenNIC for command-and-control and rotating algorithmically generated domains each month. Early variants generated 12-character domains and later shifted to 8-character patterns built from consonant-vowel pairs, expanding the monthly candidate pool from about 2,160 to 12,996 domains; one later variant contained a coding flaw that caused many summer-month domains to become invalid, disrupting parts of its own DGA-based infrastructure. Separate reverse-engineering of BazarLoader’s infection chain showed the malware commonly arrived through phishing and malicious ISO files, where an `LNK` launched a DLL via `rundll32.exe`, unpacked shellcode, and exposed the final loader. The loader used anti-analysis checks, language-based execution filtering, dynamic API resolution, decoy traffic, cryptographic validation, and process hollowing, then fetched follow-on payloads from hard-coded HTTPS IPs or fallback `.bazar` domains to deliver tools such as **Cobalt Strike** and **Conti ransomware**.
Aug 15, 2026
Researchers documented multiple **BazaLoader** campaigns that used high-interaction phishing lures, including Valentine’s Day retail themes and DocuSign-themed spreadsheets, to trick users into visiting spoofed sites, downloading malicious Excel files, and enabling macros. Once executed, the malware established persistence, injected into legitimate processes, contacted command-and-control infrastructure, and used evolving techniques such as updated `.bazar` domain-generation logic and heavily obfuscated strings to hinder detection and analysis. Incident reports showed BazaLoader frequently serving as an initial access loader for broader intrusions that quickly escalated to **Cobalt Strike**, **AdFind** reconnaissance, credential theft, lateral movement, and in some cases **Anchor DNS** deployment, behavior widely associated with **Ryuk** and later **Conti** ransomware operations. In one case, reconnaissance began within 41 minutes of infection; in another, attackers progressed from a single endpoint to domain controller access over five days, reinforcing assessments that BazaLoader was a key entry point in enterprise ransomware playbooks tied to TrickBot-aligned affiliates.
Aug 15, 2026