CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader

CountLoader is a newly identified malware loader used by Russian ransomware groups to deliver post-exploitation tools such as Cobalt Strike and AdaptixC2, as well as a remote access trojan known as PureHVNC RAT. It appears in three versions—.NET, PowerShell, and JavaScript—and is described by Silent Push as being deployed either as part of an Initial Access Broker’s toolset or by a ransomware affiliate with ties to the LockBit, Black Basta, and Qilin groups.

The three versions target individuals in Ukraine using PDF-based phishing lures and impersonating the National Police of Ukraine, with the PowerShell variant having been flagged previously by Kaspersky for use in DeepSeek-related decoys.

The JavaScript edition is the most feature-rich, offering six file-download methods, three execution methods for malware binaries, and a function to identify a victim’s device based on Windows domain information, while the loader also uses the victim’s Music folder as a staging ground. According to Silent Push, CountLoader is supported by over 20 unique domains and serves as a conduit for Cobalt Strike, AdaptixC2, and PureHVNC RAT, the latter associated with PureCoder.