Sorpresa! Jasper Loader targets Italy with a new bag of tricks
Summary: Cisco Talos reports that a new version of the JasperLoader malware loader is being distributed in campaigns targeting Italian victims, after distribution of the initially analyzed version halted and then resumed at low volume. The new version adds geolocation filtering that exits on Romanian language settings, checks WMI for hypervisor system models to evade sandbox analysis, uses Task Scheduler for persistence, and adds a date-based failback C2 domain mechanism.
Bottom line: More than 95 percent of DNS resolutions for one JasperLoader C2 domain came from Italy, showing the geofencing worked - and the developers are refining this financially motivated loader at a pace Talos says is not commonly seen in crimeware.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026