BroomstickMalware
- cleanboost
- CleanUpLoader
- Oyster
Oyster is a backdoor malware written in C++ that first appeared in July 2023. It allows for remote sessions, supporting tasks such as file transfer and command-line processing. This malware has been used by numerous threat actors as a tool to facilitate ransomware intrusions.From MISP Galaxy
Last reported 1 month ago, by Palo Alto Unit 424 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1053.005Scheduled Task
“Moved from scheduled tasks to Startup folder persistence mechanism and still using Windows 8.3 short filenames”
- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
- T1021.006Windows Remote Management
“…and 54 minutes after the initial JavaScript execution and reconnaissance activity, the threat actor moved laterally via WinRM (Windows Remote Management) to the Domain Controller.”
- T1027.007Dynamic API Resolution
“Besides, the first stage employs common techniques such API hammering and dynamic API resolution.”
- T1036Masquerading
“A DLL masquerading as a component of 360 Total Security named 360Util.dll implements persistence through COM object hijacking.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution“Oyster Backdoor”
-
C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2“…e command’s intended purpose is currently unknown.Table 3: Commands supported by C2Looper in older variants.ANALYST NOTE: Interestingly, Oyster malware (which is likely related with the threat actor behind Lactrodectus) uses similar API endpoints for C2 communication.C2Looper ver…”
-
OysterLoader Unmasked: The Multi-Stage Evasion Loader“OysterLoader, also known as Broomstick and CleanUp, spreads through fake installer sites impersonating tools like PuTTY and WinSCP.”
-
Gootloader | Threat Detection Overview“These samples are attributed to OysterLoader (also known as CleanUpLoader or Broomstick), another backdoor that Vanilla Tempest refuses to quit using.”
Indicators in its reports
named in the reports above- 1619bcad3785be31…3cb8964d4cb7in 1 report
- 5226ea8e0f516565…02c5b4ac6abdin 1 report
- dcf536edd67a9886…8af06cb036acin 1 report
- 66dbf939c00b09d8…f57b1ad047bdin 1 report
- c233aec7917cf342…3c08201a7a1cin 1 report
- e622f3b743c7fc0a…d582ca4cda22in 1 report
- b1ef7b267d887e34…c98cc74642fbin 1 report
- 20ed21bfdb7aa970…29d0e2a44e5din 1 report
- dd15ce869aa79884…2303e1ecd966in 1 report
- c398b3e06ef86067…bb2f094a14efin 1 report
- bb932056cae89407…085ae2b2baf7in 1 report
- 4fb58687a364c3f6…d424db1b1b14in 1 report
- pefile[.]pein 1 report
- exp[.]namein 1 report
- 85.239.53[.]66in 1 report
- 51.222.96[.]108in 1 report
- 135.125.241[.]45in 1 report
- hxxps://grandideapay[.]com/api/v2/facadein 1 report
- grandideapay[.]comin 1 report
- hxxp://nucleusgate[.]com/api/v2/facadein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.