A professionally engineered loader called OnionDrop is being used in high-tempo campaigns to deliver multiple infostealers at scale.
Between February 28 and May 20, 2026, YARA retro-hunting uncovered more than 645 unique OnionDrop DLL samples, and deliveries remained active at the time of publication.
The campaign’s operational footprint and evasion techniques place OnionDrop well above typical commodity loaders and, in several respects, on par with tooling usually reserved for nation-state actors.
Initial delivery relies on a deceptively simple tactic: a ZIP archive bundled with a legitimate Adobe-signed executable that sideloads a malicious DLL.
That DLL chain triggers a four-stage unpack pipeline custom byte-pair decoding, Xpress Huffman decompression via RtlDecompressBufferEx, AES-256-CBC decryption with rotating key material, and final shellcode execution culminating in a Donut-generated payload.
The loader is payload-agnostic; confirmed final payloads include LegionLoader (aka CurlyGate), CGrabber Infostealer, and Vidar Stealer. LegionLoader samples were observed calling back to gainmsg[.]com.
Native API resolution funnels through LdrGetProcedureAddress rather than LoadLibrary to bypass common hooks, and the loader performs extensive API “hammering” to flood telemetry and complicate dynamic analysis.
The Howler Cell Threat Research said in a report shared with GBhackers, OnionDrop’s evasion design is deliberate and multi-layered. Strings and API names are built at runtime through stack-string constructions and custom decryption routines.
Additional anti-analysis checks query display device strings and only proceed when names match a whitelist (INTEL, GTX, ARC, AMD, RTX, QUADRO, RADEON, GEFORCE), a measure that filters out many sandbox or virtualized environments.
The loader avoids standard detection patterns at two critical junctures. First, it spawns execution threads via NtCreateThreadEx to avoid performing long-running tasks inside DllMain and to avoid Loader Lock deadlocks.
Second, final-stage execution uses an uncommon technique: the loader registers the mapped shellcode as a Windows Thread Pool callback (TpAllocWork / TpPostWork), triggering execution without explicit CreateThread or similar APIs that generate prominent telemetry. This callback abuse reduces footprints that many endpoint agents flag.
Technically, OnionDrop’s multi-stage pipeline shows sophisticated choices: a custom byte-pair decoding step that maps input pairs through a 256-byte lookup table, followed by Xpress Huffman decompression and a multi-phase AES-CBC decryption where 32‑byte keys are assembled or rotated across stages.
The final Donut shellcode decompresses an in-memory PE (LZNT1) and resolves Win32 APIs using CRC32-hashed names, then decrypts C2 configuration (RC4) and connects using WinHttp APIs.
The operation’s modularity explains how the same loader infrastructure serviced different infostealers over time and even handed off to an intermediate Direct-sys Loader to deliver Vidar, producing delivery chains of up to five stages.
Operational indicators are tangible: the Howler Cell team published a YARA rule used to find samples and documented the campaign timeline and artifacts.
Attribution remains at the operator level: this actor has been tracked previously in CGrabber and Direct-sys Loader waves, indicating an evolving commodity loader ecosystem managed with discipline and engineering investment rather than a single bespoke espionage implant.
Defenders should prioritize detection of DLL sideloading patterns involving signed Adobe executables paired with unknown DLLs, anomalous Thread Pool callback registrations, and multi-stage decompression/decryption artifacts in memory.
Network indicators include connections to gainmsg[.]com associated with LegionLoader. Howler Cell’s report and linked analysis of prior waves (for example, the CGrabber and Direct-sys Loader write-up) provide additional IOCs and hunting guidance to disrupt this active, evasive campaign.
| C2 | hxxps[://]gainmsg[.]com/nfront[.]php |
| ZIP (1) | 8559e535128805f1e31fa7a15b33d25ae498915c7b88ea5142cf38858d551a53 |
| ZIP (2) | f09be48aab38dc85b7ad46efb98897617af66014ded44a7cf1bddaab59d9dad2 |
| DLL (1) | 18bb95789e8727be0d98d9a5fce027f0f514e74192c7736b3afa297d2ee4a8fb |
| DLL (2) | 070a97bf5bcba13c41266a79357e2a5b8d6f4e353db7427bd8ccabceee5c96e3 |
| Loader (1) | 892f1bd9663c7e14855a0238e0fbb5b2396000b3396ceda79947374a3da78912 |
| Loader (2) | c9b96846c9a49ddbed9e143b098972e1d7880654f763bb504d2f7b5d2ab1dafb |
| CGrabber | fb31df58549031f0ea24b250b214cbab9eafa39adaa715c675f328f7370904c7 |
| LegionLoader | f6e5f7445b9ea717513a04d04acfa343025ca35302d025de33935e176a83f6ae |
| Vidar | 0a8914b4f794ebc8ea1ce08dd4b5da918cd9697443007622100b0ba0731d428c |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…