New .NET Multi-stage Loader Attacking Windows Systems to Deploy Malicious Payloads

While earlier variants embedded the second stage as hardcoded strings, newer versions have adopted more sophisticated concealment methods, hiding malicious code within bitmap resources to avoid triggering security alerts. A sophisticated .NET multi-stage malware loader has been actively targeting Windows systems since early 2022, serving as a distribution channel for dangerous payloads including information stealers and remote access trojans. Statistical analysis covering March 2022 through February 2025 shows consistent deployment patterns for these payloads, highlighting the loader’s reliability as a malware delivery mechanism for cybercriminals. The research team noted that the primary value of monitoring this loader lies in obtaining fresh samples and indicators of compromise rather than early detection of new malware families. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Their tracking revealed that despite frequent changes to the first two stages, the third stage maintains a relatively stable code structure, providing a consistent signature for detection. The impact of this loader has been significant across the cybersecurity landscape, with the malware predominantly distributing commodity threats including AgentTesla, Formbook, Remcos, and 404Keylogger. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This loader employs a complex three-stage deployment mechanism that helps it evade detection while delivering malicious software to compromised machines. This carefully orchestrated process demonstrates the sophisticated techniques modern malware employs to compromise systems while remaining undetected. The threat has been continuously evolving, with recent versions implementing more advanced obfuscation techniques to hide their activities from security solutions. The third stage then manages the deployment of the final payload in memory, completing the infection chain while minimizing detection risk. ThreatRay researchers identified this loader through code reuse analysis, establishing connections between approximately 20,000 samples collected over a three-year period. This evolution demonstrates the operators’ commitment to maintaining the loader’s effectiveness against modern security solutions. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The malware begins its infection chain with a seemingly innocuous .NET executable that contains encrypted components of subsequent stages.

This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 17:09:55 +0000


Cyber News related to New .NET Multi-stage Loader Attacking Windows Systems to Deploy Malicious Payloads

CVE-2023-53109 - In the Linux kernel, the following vulnerability has been resolved: ...
1 month ago
CVE-2024-26633 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
Unit 42 Collaborative Research With Ukraine's Cyber Agency To Uncover the Smoke Loader Backdoor - This collaborative research focuses on recent Smoke Loader malware activity observed throughout Ukraine from May to November 2023 from a group the CERT-UA designates as UAC-0006. The SCPC SSSCIP has identified Smoke Loader as a prominent type of ...
1 year ago Unit42.paloaltonetworks.com
New .NET Multi-stage Loader Attacking Windows Systems to Deploy Malicious Payloads - While earlier variants embedded the second stage as hardcoded strings, newer versions have adopted more sophisticated concealment methods, hiding malicious code within bitmap resources to avoid triggering security alerts. A sophisticated .NET ...
1 month ago Cybersecuritynews.com
CVE-2025-21707 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
CVE-2024-36886 - In the Linux kernel, the following vulnerability has been resolved: ...
11 months ago
CVE-2024-26857 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
CVE-2024-35893 - In the Linux kernel, the following vulnerability has been resolved: ...
11 months ago
CVE-2024-47685 - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use ...
7 months ago Tenable.com
CVE-2024-58071 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
CVE-2024-42106 - In the Linux kernel, the following vulnerability has been resolved: ...
5 months ago
CVE-2025-37961 - In the Linux kernel, the following vulnerability has been resolved: ...
3 weeks ago
CVE-2025-21959 - In the Linux kernel, the following vulnerability has been resolved: ...
2 months ago
CVE-2024-50083 - In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending ...
7 months ago Tenable.com
CVE-2024-26781 - In the Linux kernel, the following vulnerability has been resolved: mptcp: fix possible deadlock in subflow diag Syzbot and Eric reported a lockdep splat in the subflow diag: WARNING: possible circular locking dependency detected ...
1 year ago Tenable.com
CVE-2023-52784 - In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. ...
1 year ago Tenable.com
CVE-2024-57802 - In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation. ...
5 months ago Tenable.com
CVE-2025-21858 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
CVE-2024-50035 - In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is ...
7 months ago Tenable.com
CVE-2025-21716 - In the Linux kernel, the following vulnerability has been resolved: ...
3 months ago
CVE-2022-48956 - In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid use-after-free in ip6_fragment() Blamed commit claimed rcu_read_lock() was held by ip6_fragment() callers. It seems to not be always true, at least for UDP stack. syzbot ...
7 months ago Tenable.com
CVE-2024-50033 - In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the ...
7 months ago Tenable.com
CVE-2023-53057 - In the Linux kernel, the following vulnerability has been resolved: ...
1 month ago
CVE-2024-56648 - In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fill_frame_info() is relying on ...
5 months ago Tenable.com
CVE-2024-44999 - In the Linux kernel, the following vulnerability has been resolved: ...
5 months ago