Threat actorTracked since 2026-06

OnionDrop operator

Also known as:CurlyGate operatorLegionLoader distributor

As of 2026-06-17, OnionDrop operator is a threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware. Also known as CurlyGate operator, LegionLoader distributor.

Tracked threats: 11 high
First seen: 2026-062026-06-17
Last seen: 2026-062026-06-17
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced

1 tracked threat(s) · Categories: MALWARE

Activity timeline

OnionDrop operator appears in 1 tracked threat between 2026-06-17 and 2026-06-17.

Tracked threats

OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate, CGrabber, and Vidar via DLL Sideloading and gainmsg[.]com C2HIGH2026-06-17