CountLoader: A New Malware Loader Linked to Russian Ransomware Groups

According to Silent Push’s report, researchers have identified a newly emerging malware loader named CountLoader, which they assess to be linked with multiple ransomware groups, primarily Russian-speaking cybercriminals. The campaign targets Ukrainian citizens with phishing lures, including a PDF impersonating the Ukrainian National Police.

Silent Push notes that CountLoader attempts connections to many different C2s, retrying up to a million times, an activity also observed by Cyfirma and Kaspersky in their reports. The campaign uses proprietary fingerprinting methods and links infrastructure to over 20 unique domains; three versions of CountLoader exist: a JScript-based (.hta file), a .NET binary obfuscated with custom techniques, and a lightweight PowerShell script.

Persistence is achieved by creating scheduled tasks disguised as Google Chrome update jobs, while C2 communication relies on XOR plus Base64 encryption. Payloads delivered include Cobalt Strike beacons, Adaptix C2 malware, PureHVNC, and Lumma Stealer, with a focus on domain-joined enterprise systems; analysts tie CountLoader’s activity to BlackBasta, Qilin, and LockBit affiliates based on watermark IDs and shared infrastructure.