Matanbuchus: Malware-as-a-Service with Demonic Intentions
Summary: Unit 42 researchers documented Matanbuchus, a malware-as-a-service loader advertised in February 2021 by a threat actor named BelialDemon at an initial rental price of $2,500. The loader was delivered through a malicious Microsoft Excel document using Excel 4.0 macros that downloaded ddg.dll from idea-secure-login[.]com, and Unit 42 identified impacted organizations including a large U.S. university and high school and a high-tech organization in Belgium.
Bottom line: A $2,500 rental price puts a loader with anti-sandbox checks, scheduled-task persistence, and RAT-like profiling within reach of low-budget actors, and Unit 42 traced the infrastructure to clusters of phishing domains spanning fake Flash updates, SSO and login lures, and crypto-wallet themes that may be staged for future campaigns.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026