Loaders and droppers decide what runs next on a compromised host, so the moment one executes is the cheapest point at which to stop an intrusion that may end in ransomware or long-term espionage. This hub covers the 78 software entries that NHI Mgmt Group groups as loaders, droppers, downloaders and stagers in MITRE ATT&CK Enterprise v20, all classed by ATT&CK as malware. It lists every entry with its platforms, the groups ATT&CK links to it and its most distinctive techniques, and it summarises the behaviours the category shares, computed from the v20 technique relationships. It then turns those behaviours into detection, hardening and response priorities. It is for detection engineers, threat hunters and incident responders who use ATT&CK to plan and test coverage.
Key takeaways
- Download and decode define the category. Ingress Tool Transfer (T1105) maps to 56 of the 78 entries and Deobfuscate/Decode Files or Information (T1140) to 46, more than any other techniques.
- Mostly espionage, not just crime. 64 entries are linked to at least one ATT&CK group, and APT29 alone accounts for ten, including TEARDROP and Raindrop from the SolarWinds compromise.
- Stealth is near universal. 71 of 78 entries have at least one technique in the v20 Stealth tactic (TA0005), from packing and encoding to DLL side-loading (T1574.001, 12 entries) and signed binary proxy execution through rundll32 (T1218.011, 10 entries).
- Some loaders log in rather than beacon. OilRig downloaders described by ESET use Microsoft Graph and Exchange accounts for command and control, with hardcoded credentials or OAuth refresh tokens, so identity telemetry becomes malware telemetry.
- Treat a loader alert as an intrusion. Europol's Operation Endgame in May 2024 targeted the dropper ecosystem because droppers feed ransomware; a loader on one host means a second stage may already be there.
What counts as a loader or dropper
ATT&CK does not have a loader category: it classifies each software entry as malware or a tool and describes what it does. This hub groups the entries whose ATT&CK description says their main job is to deliver, decrypt, stage or launch other code. The terms overlap in practice:
- Dropper: carries the next payload inside itself and writes or injects it, as ATT&CK describes TEARDROP, a memory-only dropper found during the SolarWinds investigations.
- Downloader: fetches the next payload from the network, as with GuLoader, which ATT&CK says has distributed NETWIRE, Agent Tesla, NanoCore, FormBook and Parallax RAT since at least December 2019.
- Loader: decrypts and launches a payload in memory, often through side-loading or injection, such as Raindrop, Ecipekac or LunarLoader.
- Stager or first-stage implant: profiles the host and waits for an operator to decide, such as PUBLOAD, which ATT&CK says collects host details, establishes persistence and encrypts victim details with RC4 before sending them to its server.
Membership follows the NHI Mgmt Group software category list. Counts are computed from the ATT&CK Enterprise v20 STIX data with revoked and deprecated objects removed. For the general discipline, see the Malware Loaders and Droppers Guide; this hub is the ATT&CK catalogue view.
Shared behaviours across the category
The 78 entries map to 171 distinct techniques and sub-techniques. By tactic, 71 entries have a Stealth technique, 63 Command and Control, 62 Execution and 54 Discovery, while only 12 have a Credential Access technique and four an Impact technique: the work of a loader ends where the payload's begins.
| Technique | Entries (of 78) | What to look for |
|---|---|---|
| T1105 Ingress Tool Transfer | 56 | A newly started process downloads an executable, DLL or script shortly after it first runs |
| T1140 Deobfuscate/Decode Files or Information | 46 | Encoded blobs decoded in memory; certutil or PowerShell decoding; high-entropy files in user folders |
| T1071.001 Web Protocols | 38 | HTTP or HTTPS requests from non-browser processes to rare domains |
| T1082 System Information Discovery | 35 | Host profiling commands run by a process with no prior history on the host |
| T1106 Native API | 28 | Direct API calls to allocate memory and create threads, visible through EDR call telemetry |
| T1059.003 Windows Command Shell | 26 | cmd.exe spawned by a document, script host or unsigned binary |
| T1027.013 Encrypted/Encoded File | 21 | Encrypted payload files written next to a launcher |
| T1547.001 Registry Run Keys / Startup Folder | 20 | New Run key values pointing at user profile paths |
| T1070.004 File Deletion | 20 | The original dropper deletes itself after the payload starts |
| T1204.002 Malicious File | 19 | A user opens an attachment, archive or disk image |
| T1574.001 DLL | 12 | A signed executable loads an unsigned DLL from its own folder in a user writable path |
| T1053.005 Scheduled Task | 12 | New tasks created by user-level processes, often with names that mimic updaters |
| T1518.001 Security Software Discovery | 12 | Queries for installed security products before the payload is released |
| T1218.011 Rundll32 | 10 | rundll32.exe running a DLL from temp, downloads or ProgramData |
Sandbox evasion also matters: seven entries use time-based checks (T1497.003) and seven use system checks (T1497.001), so a short detonation in a default virtual machine can miss the payload entirely.
Who uses these loaders
Unlike banking trojans or commodity remote access trojans, most entries in this category belong to state-linked groups that write their own first stages. The groups with the most entries in v20 are:
| Group | Entries | Examples in this hub |
|---|---|---|
| APT29 | 10 | MiniDuke, PolyglotDuke, TEARDROP, Raindrop, EnvyScout, BoomBox |
| BRONZE BUTLER | 5 | ABK, BBK, build_downer, down_new, Avenger |
| OilRig | 4 | SampleCheck5000, ODAgent, OilCheck, OilBooster |
| Mustang Panda | 4 | PUBLOAD, SplatDropper, CANONSTAGER, STATICPLUGIN |
| BlackTech | 3 | PLEAD, TSCookie, Flagpro |
| Contagious Interview | 3 | BeaverTail, XORIndex Loader, HexEval Loader |
| MirrorFace | 3 | DOWNIISSA, NOOPLDR, ROAMINGHOUSE |
Criminal loaders are still well represented: Smoke Loader (seen since at least 2011 according to ATT&CK), Hancitor, GuLoader, Pony and Latrodectus, which ATT&CK says has been distributed mainly by email campaigns from TA577 and TA578 and overlaps with historic IcedID infrastructure. See the Latrodectus and Bumblebee Loaders Guide and the Agent Tesla and Formbook Guide for the payloads GuLoader delivers.
Detection priorities
- Parent-child anomalies at first execution: Office, PDF readers, archive tools and script hosts spawning cmd.exe, PowerShell, rundll32.exe, regsvr32.exe or msiexec.exe. This is where T1204.002, T1059.003 and T1218.011 meet.
- Write then load: a file written to a user writable path and loaded or executed within minutes by a different process, especially a signed executable loading an unsigned DLL from its own folder (T1574.001).
- Self-deletion: the parent file removed shortly after a child process starts (T1070.004), a strong signal in 20 entries.
- First network contact by a new binary: any executable seen for the first time in the estate that makes outbound HTTP or HTTPS connections within its first minute (T1105, T1071.001).
- Cloud service command and control: non-browser processes calling Microsoft Graph, Exchange Web Services or cloud storage APIs with credentials that do not belong to the signed-in user. ESET reported that OilRig's ODAgent and OilBooster used OneDrive through Microsoft Graph and that SampleCheck5000 used a shared Exchange account through EWS.
- Persistence created by a process younger than five minutes: Run keys, scheduled tasks and services created by a binary that has just arrived (T1547.001, T1053.005).
For building and testing analytics against these techniques, see the ATT&CK Detection Strategies and Analytics Guide.
Hardening that blocks first stages
| Control | What it stops | Techniques |
|---|---|---|
| Application control that only allows signed, approved binaries and scripts from protected paths | Unsigned loaders and side-loaded DLLs in user folders | T1204.002, T1574.001, T1059.003 |
| Block or restrict rundll32, regsvr32, mshta and msiexec for standard users where not needed | Signed binary proxy execution | T1218.011, T1218.007 |
| Block macros, disk images and script attachments from the internet | The user execution step that starts most chains | T1566.001, T1204.002 |
| Egress through an authenticating proxy, with uncategorised and newly registered domains blocked for non-browser processes | Second-stage download and beaconing | T1105, T1071.001 |
| Tenant restrictions and conditional access that limit which Microsoft 365 tenants and apps devices can reach | Command and control through attacker-owned cloud accounts | T1102.002, T1567.002 |
| Long-running sandbox detonation with realistic user activity and locale | Time-based and system-check evasion | T1497.001, T1497.003 |
See the App Control for Business (WDAC) guide and the Application Allowlisting Guide.
Real cases
- SolarWinds compromise: ATT&CK links TEARDROP and Raindrop to its SolarWinds Compromise campaign (C0024) and to APT29, describing both as found on victim machines during those investigations and likely used since at least May 2020. They were the step between the backdoored Orion update and hands-on activity. See the SolarWinds Supply Chain Compromise breach analysis for how the intrusion then moved into identity systems.
- Operation Endgame, May 2024: Europol described actions between 27 and 29 May 2024 against droppers including Smokeloader, IcedID, SystemBC, Pikabot, Bumblebee and Trickbot, with over 100 servers taken down and four arrests, and said the approach had a global impact on the dropper ecosystem.
- Developer-targeted loaders: ATT&CK describes BeaverTail as stealing browser logins and downloading second-stage payloads, delivered through code repository sites, and HexEval Loader as delivered through repositories using typosquatted names, both by Contagious Interview.
- Cloud-powered downloaders: ESET reported on 14 December 2023 that OilRig used SampleCheck5000, OilCheck, ODAgent and OilBooster against Israeli organisations, all using shared Microsoft cloud accounts for command and control.
Where identity fits
Two parts of this category are identity problems. First, loaders that use cloud services for command and control carry credentials: ESET reported that OilBooster requests OAuth 2.0 access tokens with a hardcoded client ID, client secret and refresh token, and that SampleCheck5000 signs in to an Office 365 account with hardcoded credentials. Those are non-human identities registered in an attacker's tenant, and they show up in proxy and sign-in logs as traffic to legitimate Microsoft endpoints. Restricting which tenants and applications your devices can reach removes that channel. Second, developer-targeted loaders such as BeaverTail run where package registry tokens, cloud keys and SSH keys live, so a single infection on a developer workstation is a secrets exposure. Treat it as one: rotate tokens and keys reachable from the host. See the Contagious Interview Threat Actor Profile.
Catalogue: all 78 entries
Every member in the category, sorted by name. Associated groups are up to three intrusion sets ATT&CK v20 links to the software; where none is linked but a campaign is, the campaign is shown. "Distinctive techniques" are up to three of the entry's techniques that are least common across the hub, useful as hunting leads. Platforms are shown as ATT&CK lists them; two entries have no platform recorded.
| ID | Name | Type | Platforms | Associated groups (v20) | Distinctive techniques |
|---|---|---|---|---|---|
| S0469 | ABK | malware | Windows | BRONZE BUTLER | T1027.003, T1055, T1518.001 |
| S9027 | ANELLDR | malware | Windows | Campaign: Operation AkaiRyū | T1622, T1027.016, T1574.001 |
| S0584 | AppleJeus | malware | Windows, macOS | Lazarus Group | T1059.004, T1543.004, T1546.016 |
| S0473 | Avenger | malware | Windows | BRONZE BUTLER | T1027.003, T1055, T1680 |
| S0470 | BBK | malware | Windows | BRONZE BUTLER | T1027.003, T1055, T1059.003 |
| S1246 | BeaverTail | malware | Linux, macOS, Windows | Contagious Interview | T1195.001, T1571, T1654 |
| S0635 | BoomBox | malware | Windows | APT29 | T1087.003, T1087.002, T1102 |
| S0415 | BOOSTWRITE | malware | Windows | FIN7 | T1129, T1553.002, T1574.001 |
| S0471 | build_downer | malware | Windows | BRONZE BUTLER | T1036.004, T1124, T1027.003 |
| S9016 | Caminho | malware | Windows | APT-C-36 | T1055.012, T1027.001, T1027.013 |
| S1237 | CANONSTAGER | malware | Windows | Mustang Panda | T1055.005, T1027.007, T1564.003 |
| S0462 | CARROTBAT | malware | Windows | None linked in v20 | T1027.010, T1070.004, T1027.013 |
| S0137 | CORESHELL | malware | Windows | APT28 | T1071.003, T1027.016, T1132.001 |
| S0614 | CostaBricks | malware | Windows | Campaign: CostaRicto | T1027.001, T1027.002, T1055 |
| S0472 | down_new | malware | Windows | BRONZE BUTLER | T1132.001, T1518, T1573.001 |
| S0134 | Downdelph | malware | Windows | APT28 | T1001.001, T1548.002, T1573.001 |
| S9021 | DOWNIISSA | malware | Windows | MirrorFace | T1218.007, T1055, T1070.004 |
| S1158 | DUSTPAN | malware | Windows | APT41 | T1027.009, T1055.002, T1543.003 |
| S0624 | Ecipekac | malware | Windows | menuPass | T1553.002, T1574.001, T1027 |
| S0634 | EnvyScout | malware | Windows | APT29 | T1027.006, T1187, T1564.001 |
| S0355 | Final1stspy | malware | Windows | APT37 | T1057, T1547.001, T1027 |
| S0696 | Flagpro | malware | Windows | BlackTech | T1018, T1029, T1069.001 |
| S0628 | FYAnti | malware | Windows | menuPass | T1027.002, T1083, T1140 |
| S0666 | Gelsemium | malware | Windows | None linked in v20 | T1036.001, T1070.006, T1134 |
| S0460 | Get2 | malware | Windows | TA505 | T1059, T1055.001, T1033 |
| S0561 | GuLoader | malware | Windows | None linked in v20 | T1102, T1497.001, T1497.003 |
| S0132 | H1N1 | malware | Windows | None linked in v20 | T1080, T1091, T1132 |
| S0499 | Hancitor | malware | Windows | None linked in v20 | T1218.012, T1497, T1027.015 |
| S0214 | HAPPYWORK | malware | Not stated | APT37 | T1033, T1082, T1105 |
| S1249 | HexEval Loader | malware | Linux, macOS, Windows | Contagious Interview | T1056.001, T1614, T1059.007 |
| S9007 | HTTPTroy | malware | Windows | Kimsuky | T1132.002, T1027.007, T1113 |
| S1152 | IMAPLoader | malware | Windows | CURIUM | T1543, T1574.014, T1071.003 |
| S9029 | IronWind | malware | Windows | WIRTE | T1070, T1027.010, T1518 |
| S0648 | JSS Loader | malware | Windows | FIN7 | T1059.007, T1059.005, T1059.001 |
| S0585 | Kerrdown | malware | Windows | APT32 | T1027.015, T1059.005, T1566.002 |
| S0669 | KOCTOPUS | malware | Windows | LazyScripter | T1070.009, T1685, T1090 |
| S1160 | Latrodectus | malware | Windows | TA577, TA578 | T1021.005, T1104, T1482 |
| S1185 | LightSpy | malware | Android, Windows, iOS, macOS | APT41 | T1046, T1123, T1129 |
| S0513 | LiteDuke | malware | Windows | APT29 | T1012, T1027.003, T1497.003 |
| S0680 | LitePower | malware | Windows | WIRTE | T1012, T1113, T1059.001 |
| S1143 | LunarLoader | malware | Windows | Turla | T1137.006, T1620, T1480 |
| S0167 | Matryoshka | malware | Windows | CopyKittens | T1059, T1071.004, T1555 |
| S0051 | MiniDuke | malware | Windows | APT29 | T1090.001, T1568.002, T1102.001 |
| S0553 | MoleNet | malware | Windows | Molerats | T1047, T1059.001, T1518.001 |
| S0256 | Mosquito | malware | Windows | Turla | T1546.015, T1027.011, T1047 |
| S0637 | NativeZone | malware | Windows | APT29 | T1480, T1497.001, T1036 |
| S9025 | NOOPLDR | malware | Windows | MirrorFace | T1127.001, T1564, T1027.016 |
| S1170 | ODAgent | malware | Windows | OilRig | T1567.002, T1102.002, T1041 |
| S1172 | OilBooster | malware | Windows | OilRig | T1559, T1573.002, T1008 |
| S1171 | OilCheck | malware | Windows | OilRig | T1567, T1102.002, T1105 |
| S0435 | PLEAD | malware | Windows | BlackTech | T1001.001, T1010, T1555 |
| S0518 | PolyglotDuke | malware | Windows | APT29 | T1102.001, T1027.011, T1027.003 |
| S0453 | Pony | malware | Windows | None linked in v20 | T1110.001, T1087.001, T1027.015 |
| S0177 | Power Loader | malware | Not stated | None linked in v20 | T1055.011 |
| S0685 | PowerPunch | malware | Windows | Gamaredon Group | T1480.001, T1027.010, T1059.001 |
| S1046 | PowGoop | malware | Windows | MuddyWater | T1573, T1132.002, T1036 |
| S0613 | PS1 | malware | Windows | Campaign: CostaRicto | T1055.001, T1059.001, T1027.013 |
| S1228 | PUBLOAD | malware | Windows | Mustang Panda | T1001.003, T1016.001, T1016.002 |
| S0565 | Raindrop | malware | Windows | APT29 | T1027.003, T1497.003, T1027.002 |
| S9026 | ROAMINGHOUSE | malware | Windows | MirrorFace | T1137.001, T1497.002, T1047 |
| S1018 | Saint Bot | malware | Windows | Ember Bear, Saint Bear | T1055.004, T1218.004, T1218.010 |
| S1168 | SampleCheck5000 | malware | Windows | OilRig | T1567, T1560.001, T1074.001 |
| S0461 | SDBbot | malware | Windows | TA505 | T1021.001, T1125, T1546.011 |
| S1089 | SharpDisco | malware | Windows | MoustachedBouncer | T1120, T1071.002, T1564.003 |
| S0533 | SLOTHFULMEDIA | malware | Windows | None linked in v20 | T1001, T1489, T1569.002 |
| S0226 | Smoke Loader | malware | Windows | None linked in v20 | T1114.001, T1552.001, T1055.012 |
| S0516 | SoreFang | malware | Windows | APT29 | T1190, T1069.002, T1087.001 |
| S1232 | SplatDropper | malware | Windows | Mustang Panda | T1070.009, T1027.007, T1543.003 |
| S0188 | Starloader | malware | Windows | Sowbug | T1036.005, T1140 |
| S1238 | STATICPLUGIN | malware | Windows | Mustang Panda | T1036.008, T1559.001, T1553.002 |
| S1064 | SVCReady | malware | Windows | None linked in v20 | T1120, T1546.015, T1036.004 |
| S0464 | SYSCON | malware | Windows | Campaign: Operation Honeybee | T1071.002, T1057, T1204.002 |
| S0560 | TEARDROP | malware | Windows | APT29 | T1543.003, T1012, T1112 |
| S0094 | Trojan.Karagany | malware | Windows | Dragonfly | T1003, T1055.003, T1573.002 |
| S0436 | TSCookie | malware | Windows | BlackTech | T1095, T1090, T1555.003 |
| S0636 | VaporRage | malware | Windows | APT29 | T1480, T1071.001, T1140 |
| S0442 | VBShower | malware | Windows | Inception | T1059.005, T1070.004, T1547.001 |
| S1248 | XORIndex Loader | malware | Windows | Contagious Interview | T1614, T1027.010, T1059.007 |
Framework mapping
| Framework | Reference | Relevance to loaders |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection | Detecting and blocking first-stage malware |
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality | Restricting script hosts and proxy execution binaries |
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring | Process, file and network telemetry for write-then-load chains |
| NIST CSF 2.0 | PR.PS-05 | Installation and execution of unauthorised software are prevented |
| NIST CSF 2.0 | DE.CM-01 | Networks and network services are monitored for adverse events |
| CIS Controls v8.1 | Control 2 and Control 10 | Software inventory and allowlisting; malware defences |
| ISO/IEC 27001:2022 | Annex A 8.7 and 8.19 | Protection against malware; installation of software on operational systems |
Common failure patterns
- Quarantine and close. The loader is removed but nobody checks whether it already fetched and launched a second stage.
- Allowlisting by publisher only. Side-loading abuses signed executables, so trusting any binary signed by a known vendor lets the malicious DLL run beside it.
- Short sandbox runs. Time-based and system checks mean a two-minute detonation in a default image reports the file clean.
- Trusting Microsoft endpoints. Traffic to Graph or Outlook is exempted from inspection, which is exactly the channel cloud-powered downloaders use.
- Developer workstations outside policy. Developer machines are excluded from application control, and the loaders that target developers land there.
Practitioner checklist
- Check your detections against the 14 shared techniques in the behaviour table.
- Alert on signed executables loading unsigned DLLs from user writable paths.
- Correlate file write, execution, self-deletion and first network contact by new binaries.
- Restrict rundll32, regsvr32, mshta and msiexec for users who do not need them.
- Apply tenant restrictions so devices can only reach your own Microsoft 365 tenants.
- Run sandboxes long enough, with realistic activity, to defeat time-based checks.
- Investigate every loader detection for a second stage before closing it.
- Rotate secrets reachable from any infected developer workstation.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: ATT&CK STIX Data (Enterprise v20)
- MITRE ATT&CK: SolarWinds Compromise (C0024)
- MITRE ATT&CK: GuLoader (S0561)
- Europol: Largest ever operation against botnets hits dropper malware ecosystem
- ESET: OilRig's persistent attacks using cloud service-powered downloaders
Related NHI Mgmt Group resources: ATT&CK Banking Trojans Software Hub, ATT&CK Remote Access Trojans Software Hub, Malware Loaders and Droppers Guide, MITRE ATT&CK Guide for Defenders.