Erik

❗️Spamhaus’ Cyber Threat Intelligence Unit has identified a new malware loader, "SolarisLoader," used to deliver additional malware and stealers while using evasion and persistence techniques to avoid detection. Key findings and link to the full report below ⤵️⤵️ 📄 Research: spamhaus.com/resource-center… 🕵‍Author: Nikolaos Totosis, Senior Threat Researcher Key findings: ➡️ SolarisLoader is being used by an unknown threat actor to actively deliver additional loaders and stealers. ➡️ Rather than relying on obfuscation, it abuses the Safetica Windows Driver to disable Windows services and terminate EDR processes, helping it avoid detection and improve infection success. ➡️ It patches Windows' internal Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) through direct opcode modification, effectively blinding Windows telemetry before persistence is established. ➡️ Persistence is reinforced through a combination of scheduled task registration, registry-based self-backup, and a watchdog process that automatically relaunches the implant after the victim reboots. ➡️ The malware stealer has already evolved through 10 distinct versions, confirming active development and ongoing operational use by the threat actor. #ThreatIntelligence #Solaris #Malware #ThreatResearch