Zloader Malware Used as Gateway for Ransomware Deployment in Corporate Networks

Zloader, a Zeus-based modular trojan, first emerged in 2015 and has transformed from a banking-focused threat into a tool for initial access and ransomware deployment in corporate networks. After a near two-year hiatus, it reappeared in September 2023 with major enhancements to obfuscation, domain generation, anti-analysis capabilities and network communications.

According to Zscaler ThreatLabz, two new versions—2.11.6.0 and 2.13.7.0—show marked improvements in network communications, anti-analysis techniques and evasion. The latest variants also feature new generic filenames,Updater.exe and Updater.dll, broader obfuscation using XOR-based decoding, and upgraded DNS tunnelling alongside WebSockets support to blend with legitimate traffic.

They implement LDAP functionality to assist network discovery and lateral movement within Active Directory environments, enabling threat actors to perform directory searches and manage LDAP sessions. Zloader’s evolution highlights its shift from banking malware to a sophisticated initial access tool with capabilities spanning from ransom‑assault deployment to persistent presence across targeted corporate entities, according to the report published on 23 September 2025.