Do Son 
At a glance
| Factor | Details |
|---|---|
| Malware Family | SynkLoader |
| Threat Actor | Suspected initial access broker or ransomware affiliate (Low-to-medium confidence) |
| Target or Victims | Corporate networks and enterprise employees |
| Delivery Vector | Microsoft Teams spear-phishing messages posing as IT helpdesk staff |
| Key Capabilities | Multi-language execution, fake lock-screen phishing, and backconnect proxy tunneling |
| Source | Expel Incident Response |
TL;DR
Security researchers at Expel recently identified a novel threat called SynkLoader malware. This modular loader utilizes a wide collection of memory-resident components across several programming languages. Furthermore, the malware steals user credentials through a fake lock screen and establishes backconnect tunnels into corporate networks.
Delivery
The intrusion begins with a targeted social engineering campaign inside Microsoft Teams. Specifically, an attacker reaches out to an employee while impersonating a corporate IT support representative. The sender uses a standard Microsoft 365 default tenant domain to appear credible.
During the conversation, the fake technician directs the victim to download a maintenance utility. The operator hosts this file on a Microsoft Azure Blob storage URL. Consequently, the download link appears trustworthy to the user.
The downloaded file arrives as an MSI package titled PowershellCleaner. Once launched, the installer extracts a PowerShell script named cleaner.ps1 along with a compressed archive into local application directories. The installer executes the script immediately in the background without displaying graphical elements.
Infection Chain
The initial PowerShell script decodes an encrypted block directly into system memory. As a result, no malicious PowerShell script files touch the local hard drive. The script creates a random sixteen-character folder inside the AppData directory. Next, it extracts a standalone Python runtime environment and the primary loader script named ss.py.
Expel analysts noted that “The loader ships a long chain of attack tools, which bridge multiple separate programming languages, with some modules using as many as three programming languages at once.”
Profiling and Multi-Language Execution
The main Python loader initiates system profiling by loading a fake Microsoft runtime library called msvcp150.dll. However, this file is actually a custom C# module that executes arbitrary PowerShell commands in memory.
The malware collects the local hostname, active user accounts, running processes, and installed services. In addition, it queries Active Directory domain controllers to count connected network computers. This metric helps ransomware operators evaluate the total financial value of an enterprise network.
Task Scheduler Persistence via COM
After profiling the target, the loader deploys a second helper library named msvcp160.dll. This native dynamic link library acts as an in-memory binary loader. It maps subsequent payloads into RAM without writing them to disk.
To maintain system access, the loader establishes a scheduled task using the Component Object Model (COM) interface. Specifically, it connects directly to the Task Scheduler COM provider. This method bypasses standard command-line monitoring tools that detect schtasks.exe activity. The task runs whenever a user logs in and repeats daily at 10 AM.
Command-and-Control and Data Exfiltration
The primary loader contacts its command servers using a modified ChaCha20 encryption cipher. To evade cryptographic detectors, the authors altered the default cipher constants. The malware beacons every ninety to one hundred twenty seconds to request new instructions.
According to the analysis published by Expel, the team observed hands-on-keyboard activity during analysis. Expel researchers explained, “We discovered a new malware family which consists of a modular loader and an array of unique memory-resident components, all of which bridge multiple programming languages to avoid detection.”
PhishLocker Lock Screen Theft
The operators deploy an unusual credential phishing module known as PhishLocker. This graphical component creates a borderless full-screen window that mimics the native Windows lock screen.
Expel highlighted this technique, stating that “The malware attempts to phish the user’s system login credentials by creating a fake lock screen.”
The fake interface captures the victim’s plaintext password when they attempt to unlock their workstation. Because the prompt runs locally, attackers obtain raw single sign-on passwords instead of password hashes.
Network Tunneling and Interactive Access
Next, the threat actor deploys a reverse proxy module called TrafficRedirector. This tool establishes an outbound connection to an external relay server. It routes traffic back into the local corporate network. Therefore, attackers can access internal network services and bypass IP perimeter allow-lists.
Finally, the operator launches an interactive reverse shell and a Python VNC server. The VNC tool streams desktop screenshots and transmits remote mouse actions. The extensive and structured code comments inside the VNC component suggest the developers used artificial intelligence coding assistants during development.
Defense and Detection Guidance
Organizations must train employees to verify all internal IT communications received via collaboration tools. Security policies should block users from executing unapproved MSI packages downloaded from external links.
In addition, endpoint security teams should monitor for unusual Python runtime executions from user AppData directories. Defenders should also inspect memory allocations for unlinked dynamic libraries. Finally, implementing multi-factor authentication across all single sign-on platforms neutralizes passwords harvested by the SynkLoader malware attack chain.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
