PUBLOADMalware
- ClaimLoader
PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components. PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2.From MITRE ATT&CK
Last reported 3 months ago, by Group-IB2 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1036Masquerading
“Masquerading: Match Legitimate Name”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“…ing with signed binaries overlaps with Mustang Panda’s documented PlugX delivery and the callback-API loader execution style with the ClaimLoader family.”
-
JSAC2026 -Day 1-“The “Stately Taurus” cluster involved tools including HIUPAN, USBFect, PUBLOAD (spread via USB), and CoolClient variants.”
Indicators in its reports
named in the reports above- 43.106.71[.]28in 1 report
- hxxps://github[.]com/serjs/socks5-serverin 1 report
- hxxps://github[.]com/xmrig/xmrig-proxyin 1 report
- photo.pokok.edu[.]hkin 1 report
- pta.sfaeps.edu[.]hkin 1 report
- sylverixstrategy[.]comin 1 report
- gouvvbo[.]topin 1 report
- 853f760f76de3201b0af0e41f1f65fbain 1 report
- e067ffea77875ae0dc13d4ce045931d3in 1 report
- 8.217.190[.]58in 1 report
- claude-pro[.]comin 1 report
- license.claude-pro[.]comin 1 report
- update-trellix[.]comin 1 report
- 192.252.186[.]62in 1 report
- 104.21.60[.]96in 1 report
- 161.35.236[.]255in 1 report
- vertextrust-advisors[.]comin 1 report
- 178.128.108[.]89in 1 report
- update-crowdstrike[.]comin 1 report
- update-sentinelone[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.