“Purchase Order” Deception: Sophisticated Loader Targets Manufacturing Giants in Italy, Finland, and Saudi Arabia

A CRIL report describes a highly sophisticated cyber-espionage campaign that targets the manufacturing and government sectors across Europe and the Middle East, using a “Swiss Army Knife” style loader to deploy a range of remote access trojans.

The campaign has focused its crosshairs primarily on organisations in Italy, Finland, and Saudi Arabia, with attacks entering through weaponised Office documents and malicious SVG files before funneling into a single “unified commodity loader.” This loader acts as a universal adapter capable of delivering malware such as PureLog Stealer, Katz Stealer, DC Rat, Async Rat, and Remcos.

According to Cyble Research and Intelligence Labs (CRIL), identical loader artifacts and execution patterns link this campaign to a broader infrastructure shared across multiple threat actors, suggesting the loader may be exchanged as a service in the cybercriminal underground.

The attackers employ a four-stage evasion pipeline, including steganography to hide payloads in images hosted on Archive[.]org, and a hybrid assembly technique that trojanises the legitimate TaskScheduler library to maintain authentic appearance. They also monitor system events to trigger UAC prompts during legitimate launches, enabling elevated privileges. December 23, 2025. According to Cyble Research and Intelligence Labs (CRIL).