Malware

CountLoader

According to Silent Push, this malware exists in multiple versions, including .NET, PowerShell, and JScript. They believe it is part of an IAB toolset or used by a affiliate with ties to LockBit, BlackBasta, and Qilin ransomware groups. CountLoader was also recently used in a PDF-based phishing lure targeting individuals in Ukraine, in a campaign that impersonated the Ukrainian police.

Indicators of Compromise 3

Filename certutil Filename findstr IP 213[.]139[.]77[.]109

MITRE ATT&CK TTPs 9

T1027
Obfuscated Files or Information
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1132.001
Standard Encoding
Command And Control
 T1202
Indirect Command Execution
Defense Evasion
 T1218.001
Compiled HTML File
Defense Evasion
 T1566
Phishing
Initial Access
 T1610
Deploy Container
Defense Evasion

Source Articles

New DOUBLECUP ClickFix service hides malware in browser cache images
A Russian loader-as-a-service named DOUBLECUP has been active since June 2026, enabling threat actors to conduct ClickFix attacks by hiding malicious payloads in steganographic PNG images cached in victims' browsers. The service provides infrastructure for hosting malicious images, managing sessions, and delivering payloads, which include an updated CountLoader malware and a new Python-based RAT called DeviceManager. Victims are lured to malicious sites impersonating legitimate services like NetSuite and Salesforce, where fake CAPTCHA prompts trick them into executing commands that extract and run malware from the browser cache. DeviceManager uses blockchain smart contracts (EtherHiding) to dynamically retrieve C2 addresses, enhancing resilience against takedown efforts.
bleeping-computer ·2h ago