Sauron Loader Malware Targets German Organizations via DLL Side-Loading

• •Sauron Loader is used in targeted attacks on German organizations.
• •The malware utilizes DLL side-loading and in-memory decryption to evade detection.
• •It operates as a final stage in social engineering attack chains.

Sauron Loader, a new malware loader, has been identified in attacks against German organizations. It operates as a final stage in intrusion chains initiated through social engineering and ClickFix campaigns. The malware is distributed via malicious MSI packages and is designed to gather telemetry from host systems and execute additional malware. Analysts from DCSO linked the loader to underground sales posts targeting Russian-speaking criminals. The malware employs DLL side-loading and in-memory decryption techniques to evade detection, complicating traditional security measures. Current investigations have not quantified the number of affected systems or identified all final payloads. The loader can create scheduled tasks to maintain persistence on infected machines. Security products like Symantec's Carbon Black are reportedly capable of blocking associated malicious indicators.