Loading story…
Researchers reported that DBatLoader—also tracked as ModiLoader and NatsoLoader—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as Remcos RAT and Warzone RAT. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a 4.3 MB base64 text file from OneDrive, decoded additional components on the host, and led to TLSv1.3 command-and-control traffic with 146.70.158[.]105 over TCP 9138, consistent with Remcos activity. Another sample abused Discord attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP 1990.
Technical analyses describe DBatLoader as a Delphi-based loader that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into C:\Users\Public\Libraries. It establishes persistence through HKCU\Software\Microsoft\Windows\CurrentVersion\Run, malicious shortcuts, and copied binaries, while some variants also abuse a Mock Trusted Directories UAC bypass and a relative-path DLL hijack involving easinvoker.exe and netutils.dll to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including OneDrive, Google Drive, and Discord, and has been seen distributing Formbook, Netwire RAT, Remcos RAT, and Warzone RAT against business users, including targets in Europe.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A phishing campaign used an HTML attachment named PO-2200934-KINQTE.html that unpacked a RAR archive containing a DBatLoader executable, which then downloaded an encrypted next-stage payload from OneDrive. The decrypted payload was identified as WarZone RAT, and the analysis published hashes for the lure and payloads plus the C2 endpoint halal[.]home-webserver[.]de:3109.
On the same day, executing the ISO-borne ModiLoader infected a Windows host, retrieved a 4.3 MB base64 payload from OneDrive, and led to Remcos RAT activity. The infected system then initiated TLSv1.3 communications with 146.70.158[.]105:9138 and sent at least 49 MB of outbound data while establishing persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and C:\Users\Public\Libraries.
A malicious email masquerading as a purchase order was received in a honeypot account at 04:14 UTC, carrying an ISO attachment that contained a ModiLoader executable disguised with an Excel icon.
A second YARA rule, win_dbatloader_w0, was created to detect a cryptographic routine associated with win.dbatloader, with metadata listing Daniel Plohmann as author.
A YARA rule named win_dbatloader_auto for detecting the win.dbatloader malware family was autogenerated by yara-signator, with metadata attributing authorship to Felix Bilstein.
VinCSS published a technical analysis of a ModiLoader sample delivered via malspam that used multiple Delphi-based stages, runtime decryption, and in-memory execution to retrieve and launch a final Warzone RAT payload. The analysis also documented persistence through Vwnt.url and Vwntnet.exe in %USERPROFILE%\AppData\Local and a Run key named "Vwnt" under HKCU.
Check Point Research published an analysis of the Warzone RAT malware family in a report titled "Warzone: Behind the enemy lines." This is an earlier documented research milestone for Warzone RAT than the existing timeline entries.
Zscaler described DBatLoader as a Delphi-based loader that uses multilayer obfuscation and image steganography, downloads later stages from cloud services such as OneDrive and Google Drive, and drops files into C:\Users\Public\Libraries. The analysis detailed its Mock Trusted Directories UAC bypass, relative path DLL hijack using easinvoker.exe and netutils.dll, Defender exclusions via PowerShell, and persistence through a .url shortcut and Run key.
Netskope documented a DBatLoader/ModiLoader sample that downloaded its second stage from Discord attachment URLs and ultimately executed an embedded Warzone RAT payload via process hollowing. The sample established persistence by copying itself to %AppData% as "windows explorer.exe" and creating a Windows Registry autorun entry.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourcekienmanowar.wordpress.com
Open sourceisc.sans.edu
Open sourcenetskope.com
Open sourceblog.vincss.net
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked **Batloader** activity to the **Water Minyades / DEV-0569 / SteelClover** ecosystem, which used malvertising, SEO poisoning, and fake software download pages to lure victims into installing trojanized packages. The campaigns abused legitimate installer frameworks such as **Advanced Installer** and **WiX**, then shifted to obfuscated JavaScript and PyArmor-protected Python loaders that fingerprinted hosts, contacted command-and-control infrastructure, escalated privileges, and attempted to disable security tools. Operators also used cloned software sites and malicious Google ads to distribute MSI files that launched PowerShell, added Microsoft Defender exclusions, and retrieved encrypted follow-on payloads. The infections were used to selectively deploy a broad set of malware, including **Qakbot**, **Ursnif**, **Vidar**, **ZLoader**, **RedLine Stealer**, **Raccoon Stealer**, **Cobalt Strike**, and remote-management tools such as **Atera** and **Syncro**. Trend Micro reported that Batloader infections observed from September 2022 onward were associated with **Royal ransomware**, while NTT documented a surge of related infections at Japanese companies in early 2023 through the **FakeGPG** and **BatApp** campaigns. The activity was concentrated heavily in the United States but also affected Canada, Germany, Japan, and the United Kingdom, underscoring Batloader's role as a flexible initial-access platform for both credential theft and ransomware intrusion chains.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026