Zloader Resurfaces: Stealthier Trojan Evolves with DNS Tunneling and WebSocket C2

Zloader has resurfaced after nearly two years with new versions that include enhanced anti-analysis, obfuscation and updated command-and-control capabilities, according to Zscaler ThreatLabz. The report notes that the malware, also known as Terdot, DELoader, or Silent Night, is now a modular platform suitable for ransomware operators and initial access through corporate networks.

ThreatLabz highlights that Zloader 2.13.7[.]0 adds improvements to a custom DNS tunnel for C2 communications and introduces WebSocket support to blend traffic with legitimate web activity. The gang behind it has replaced the old Domain Generation Algorithm with Base32-encoded DNS payloads and introduced two generic filenames, Updater.exe and Updater.dll, to increase flexibility.

LDAP functions have been added to improve network discovery and lateral movement, while the malware also employs multi-layer obfuscation and checks for high Windows integrity levels to evade sandboxes. According to the report, Zloader remains deployed in a targeted manner, suggesting alignment with initial access broker operations rather than broad distribution. 24 September 2025.