Modern Loader delivers multiple stealers, cryptominers and RATs
Summary: Cisco Talos traced a June 2022 command line to a Russian-hosted server at 31.41.244[.]231 that delivers a PowerShell loader, which uses a modified SharpHide utility to hide a registry Run key and a scheduled task named "OneDrive Standalone Update Task," then loads modules that disable AMSI and inject a ModernLoader RAT into RegSvcs.exe and svchost.exe. ModernLoader, in use since at least 2019, beacons to a hardcoded C2 over HTTP POST, executes only command-line or file-download tasks, and had more than 10 additional modules hosted on the C2, with two related March 2022 campaigns tied together by shared infrastructure and Visual Basic 6 downloaders posing as Brave and Visual Studio Community updates.
What's compelling: The loader's modules often exist only in RAM, so file-based detection sees nothing, and the campaign's reliance on a single C2 IP means it dies when that server goes offline - but the same actor can swap in new modules in real time.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026