OysterLoader: A Stealthy Multi-Stage Malware Tied to Rhysida Ransomware OysterLoader (also known as Broomstick or CleanUp) is a sophisticated C++-based malware loader actively used in campaigns linked to the Rhysida ransomware group. First observed in mid-2024, it spreads through malvertising and SEO-poisoning tactics, disguising itself as trojanized installers for popular IT tools like PuTTY, WinSCP, and Google Authenticator. Once executed, OysterLoader establishes a covert foothold, capable of delivering Rhysida ransomware or commodity info-stealers such as Vidar. Rhysida operators, part of the broader WIZARD SPIDER/Vanilla Tempest cybercrime ecosystem, have heavily invested in this tool, leveraging fraudulent code-signing certificates and malicious ad infrastructure to sustain campaigns despite revocations. While primarily associated with Rhysida, OysterLoader’s payload flexibility suggests it may circulate within a closed criminal network rather than being exclusive to a single group. ### Evasion Tactics & Infection Chain OysterLoader employs a four-stage infection process, beginning with a seemingly legitimate Microsoft Installer (MSI) package often signed to bypass trust checks. Key evasion techniques include: - Stage 1: Acts as a packer/obfuscator, loading the next stage from a shuffled memory blob while flooding execution with superfluous Windows API calls (e.g., GDI functions) to mislead detection. Anti-analysis measures include debugger checks and dynamic API resolution via per-sample hashing. - Stage 2: Uses shellcode with a custom LZMA-like decompression routine, dynamically resolving imports and adjusting memory protections before executing the reconstructed payload. - Stage 3: Functions as a downloader and environment verifier, checking system language and process counts before contacting command-and-control (C2) servers. Earlier variants used HTTPS endpoints with spoofed headers, hiding the next stage in image files via steganography and RC4 encryption. Persistence is achieved via scheduled tasks (e.g., `rundll32` executing `COPYING3.dll` in `%APPDATA%`). - Final Stage: Delivers Rhysida ransomware or other payloads via a DLL-based core, communicating over plain HTTP or domain-based C2 infrastructure. Recent versions use evolving API paths (e.g., `/api/v2/init`, `/api/v2/facade`) and non-standard Base64 encoding with dynamic alphabet shifts to evade detection. ### C2 Infrastructure & Ongoing Threats As of January 2026, active C2 domains include `grandideapay[.]com`, `nucleusgate[.]com`, and `socialcloudguru[.]com`, hosting endpoints like `/api/v2/facade`. The malware’s resilience stems from realistic browser user-agents, multi-server fallback logic, and adaptive encoding schemes, complicating static detection. OysterLoader’s evolution highlights the growing sophistication of loader malware, blending legitimate-looking installers, steganography, and dynamic C2 protocols to evade defenses before deploying ransomware or data-stealing payloads.