Matanbuchus 3.0 Downloader Pivots to Ransomware, Using Protobufs and QuickAssist for Stealth Access

A malware campaign has resurfaced with a major overhaul, as Matanbuchus 3.0, a sophisticated C++ downloader, is described as moving beyond a simple downloader to serve as a gateway for ransomware operators. According to Zscaler ThreatLabz, version 3.0 was identified in the wild as of July 2025, with the threat now using Protobufs to serialise network data and adopting a more modern architecture to evade analysis.

The campaign relies on direct human interaction to bypass perimeters, with the threat actor using QuickAssist to gain initial access and then downloading a malicious MSI package from gpa-cro[.]com, dropping HRUpdate.exe and employing DLL sideloading to run the downloader module. Once inside, it can download shellcode that creates a scheduled task for persistence and has been observed distributing the Rhadamanthys information stealer and the NetSupport RAT to further compromise networks.

While the operator-level capability still includes hands-on keyboard activity and the ability to deploy additional payloads, the overall emphasis now centres on providing a foothold for ransomware gangs to conduct devastating attacks.