SquidLoader is a highly evasive shellcode loader first reported by LevelBlue Labs in 2024 and tracked into 2025 by Trellix. It is delivered via targeted spear-phishing, typically a binary disguised as a Microsoft Word document, and its defining trait is near-zero antivirus detection driven by aggressive anti-static and anti-dynamic analysis. Its attack chains culminate in a Cobalt Strike Beacon. The 2025 reporting focuses on a campaign against Hong Kong financial-sector organisations, with indications of related activity elsewhere in the Asia-Pacific region.
Overview
SquidLoader was first observed by LevelBlue Labs in late April 2024, targeting Chinese-speaking organisations, with a public write-up in June 2024. In 2025 Trellix documented a new wave against Hong Kong financial services, with samples suggesting possible activity in Australia and Singapore. It is attributed only to an unknown actor that has targeted Chinese-speaking victims for roughly two years, and it consistently fetches a Cobalt Strike Beacon as its second stage.
Evasion
- Decoy document: a PE binary disguised as a
.docfile. T1036 - Anti-static analysis: encrypted code sections, large volumes of junk code, control-flow obfuscation and string obfuscation. T1027.002 T1140
- Anti-dynamic analysis: debugger detection and self-termination if analysis tools or AV processes are running — 2025 reporting names
windbg.exe,ida64.exeandMsMpEng.exeamong them. T1622 T1518.001 - Direct syscalls to bypass user-mode API hooking by EDR; the result is near-zero detection at time of analysis. T1106
Delivery
Delivery is targeted spear-phishing. The 2025 Hong Kong campaign used Mandarin-language emails impersonating financial institutions, carrying a password-protected RAR archive posing as an invoice; inside is a PE binary disguised as a Word document. T1566.001 T1204.002
MITRE ATT&CK Mapping
Analyst-mapped; confirm against the LevelBlue and Trellix tables.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1566.001 Spearphishing Attachment | Invoice-themed RAR |
| Defense Evasion | T1036 Masquerading | PE posing as .doc |
| Defense Evasion | T1027.002 Software Packing | Encrypted sections, junk code |
| Defense Evasion | T1622 Debugger Evasion | Self-terminate on analysis tools |
| Execution | T1106 Native API | Direct syscalls, unhooking |
| Command and Control | T1105 Ingress Tool Transfer | Cobalt Strike Beacon |
Detection & Mitigation
- Block executables inside archives and password-protected RAR attachments at the mail gateway; verify true file type against extension.
- Use EDR with direct-syscall and unhooking detection and in-memory Cobalt Strike detection; detonate in sandboxes that resist anti-analysis checks.
- Hunt for processes that self-terminate on the presence of analysis tools and for anomalous direct-syscall patterns.
Stop Loaders Before the Payload
Mjolnir Security helps organisations detect evasive loaders and the Cobalt Strike activity they enable.
- Managed Detection and Response Monitoring for direct-syscall unhooking, analysis-tool self-termination and Cobalt Strike beaconing.
- Email Security and Phishing Defense Archive and true-file-type controls against invoice-themed spear-phishing.
- 24/7 Incident Response Containment before hands-on-keyboard escalation. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts