OysterLoader Malware Loader Revealed with Rhysida Ransomware Connections

Cybersecuritynews

OysterLoader Malware Loader Revealed with Rhysida Ransomware Connections

First seen 13 Feb 2026, 10:10 UTC • •45.2

Article Content

1 / 6

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

OysterLoader, a multi-stage malware loader, has been identified as a significant cybersecurity threat. First discovered in June 2024, this C++ malware employs advanced obfuscation techniques to avoid detection and is primarily distributed via counterfeit websites mimicking legitimate software applications. It has been linked to the Rhysida ransomware, further complicating the threat landscape.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 202d ago How this analysis works

Timeline

2024-06-01

OysterLoader first identified by Rapid7

2026-02-13

OysterLoader's advanced obfuscation tactics reported

More articles in this cluster (5)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Ransomware
T1027 - Obfuscated Files Or Information

Malware (1)

OysterLoader

Threat Actor (1)

Rhysida

Relationships

Rhysida uses OysterLoader
Rhysida uses Malware
Rhysida uses Ransomware
Rhysida uses T1027 - Obfuscated Files Or Information

Following this threat?

Track Rhysida and OysterLoader in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Node.js Exploited in Ransomware Attacks Using EtherHiding Technique Since February 2026, threat actors have been exploiting the trusted Node.js runtime to deploy malicious payloads in targeted attacks against government departments, technology companies, and hotels. The technique leverages node.exe, a legitimate and signed developer tool, allowing attackers to run interpreted scripts…

Ransomware Attack on Berlin Senate: Data Exfiltration and Phishing Vector In August 2026, the Berlin Senate Administration suffered a significant ransomware attack attributed to the group Rhysida, initiated by a phishing email that led to a fake CAPTCHA prompt. The attack exploited a method called TerminalFix, allowing attackers to execute malicious code and gain access to sensitive data.…