Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
-
A new Windows malware loader dubbed AvisLoader is drawing attention for its use of encrypted peer-to-peer communications, a design choice that makes its command-and-control infrastructure significantly harder to take down. According to research from Varonis, the loader combines several familiar Windows abuse techniques with a resilient C2 model.
Delivery and persistence
- The malware is delivered through ClickFix, a social-engineering technique that tricks users into running malicious commands themselves.
- Persistence is established via shortcut-based mechanisms on the infected host.
- Once active, the loader provides remote command execution capabilities to its operators.
The peer-to-peer component is the standout feature: rather than relying solely on centralized servers that defenders can seize or block, AvisLoader uses encrypted P2P communications, complicating disruption efforts.
The researchers have not published a specific CVE identifier for this threat, so no advisory number is cited here.
Source: BleepingComputer
Has your organization encountered ClickFix-style delivery attempts, and how are you defending against them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login