Olymp Loader: New Assembly-Based MaaS Is a Turnkey Solution for Low-Tier Cybercriminals

A new Malware-as-a-Service (MaaS) offering, dubbed Olymp Loader, is rapidly gaining traction in underground markets, evolving from a botnet prototype into a fully fledged loader and crypter platform for low- and mid-tier criminals. First spotted in June 2025, the project is advertised as fully written in assembly language and marketed as FUD (Fully UnDetectable), according to Outpost24.

The tool, previously branded “Olymp Botnet,” dropped centralized C2 functionality after its web developer left, and now focuses on loader, crypter, and stealer capabilities, with OLYMPO claiming a three-developer team with more than a decade of assembly experience. Pricing ranges from $50 for a classic stub to $200 for unique stubs with personal injection routines, underscoring a professionalised service model.

Distribution vectors observed include fake Node.js installers on GitHub, abuse of Pay-Per-Install services with Amadey acting as a delivery stage, and impersonation of brands like NodeJS, CapCut and PuTTY, complete with borrowed certificates and spoofed icons. Olymp Loader also features built-in stealer modules and a persistence-enhancing, evasion-focused design, positioning it as a turnkey MaaS ecosystem that could accelerate commodity malware campaigns worldwide.