New Loader “CountLoader” Uses PDFs to Launch Ransomware Attacks

Security researchers have uncovered CountLoader, a new malware loader that uses weaponised PDF files to deliver ransomware payloads across multiple regions, with a focus on Ukrainian targets. The loader operates in three versions—.NET, PowerShell, and JScript—and appears connected to several ransomware ecosystems, with claims that CountLoader is linked to groups including LockBit, BlackBasta, and Qilin.

Its campaigns feature a PDF lure impersonating the National Police of Ukraine, distributed in a zip file named “vymoha_na_yavku” (summons to appear). Technical analysis notes CountLoader’s JScript version contains about 850 lines of code and that the malware uses six file-downloading methods, three execution techniques, and a domain generation algorithm for its C2 communications, employing XOR with Base64 encoding. Persistence is achieved via registry modifications and scheduled tasks, including a Run key entry and a Google Chrome update-name task.