ctrlINT What the industry said about every indicator, with the quote

Octowave LoaderMalware

Octowave Loader is a malware loader used to run other families of malware. This is often made up of an MSI or Inno Setup installer for a legitimate piece of software that has been trojanised to include a number of malicious DLLs which inevitably load and run malicious code often stored within a WAV file that is also delivered to an endpoint.From MISP Galaxy

Last reported 24 days ago, by The Hacker News2 reports

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1684Social Engineering

    “"Overall, threat actors continue to turn trusted platforms into convincing entry points for social engineering, whether via ChatGPT's Custom GPT feature or through Google Sites for hosting a ClickFix attack," Huntress said.”

    The Hacker NewsNews
  2. T1053.005Scheduled Task

    “…ses a legitimate, Canon-signed application to sideload malicious code, then sets up two persistence mechanisms, a User Run key and a scheduled task, both named Canon Configuration Reader.”

    HuntressVendor
  3. T1547.014Active Setup

    “… trojanized installer that drops an infostealer, a Node.js implant, and a batch script that establishes persistence through a Windows Active Setup registry key.”

    The Hacker NewsNews
  4. T1564.003Hidden Window

    “…e MSI comes over plain HTTP), downloads the MSI from the same decimal-IP host, installs it silently with msiexec /qn /norestart in a hidden window, and then deletes itself.”

    HuntressVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “…ve smuggled their payload within audio and video file formats, WAV-hidden payloads have been previously observed in connection with Octowave Loader campaigns.”

    The Hacker NewsNews
    Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

  2. “…ealer campaign stuffed its payloads into .wav, .mp3, .png and .mp4 files behind a PureCrypter layer, and WAV-hidden payloads are an Octowave Loader trademark.”

    HuntressVendor
    Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Octowave Loader here?
No account needed. We do not store your IP address.