OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate, CGrabber, and Vidar via DLL Sideloading and gainmsg[.]com C2

OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate (TL-2026-0831), also tracked as OnionDrop, is a high-severity malware campaign, first published 2026-06-17. It is attributed to OnionDrop operator with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0831

Threat ID
TL-2026-0831
Also known as
OnionDrop, OnionDrop Loader
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-17
Last reviewed
2026-06-17
Attribution
OnionDrop operator
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
broad/opportunistic, consumer, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

Malware and tooling: OnionDrop, LegionLoader / CurlyGate

OnionDrop is an actively-delivered, payload-agnostic Windows malware loader (part of the LegionLoader/CurlyGate ecosystem documented by Cyderes' Howler Cell) that abuses DLL sideloading of an Adobe-signed AcroBroker.exe to execute a four-stage unpacking pipeline and deliver CGrabber, LegionLoader, and Vidar infostealers. It calls back to gainmsg[.]com/nfront.php and combines nation-state-grade evasion (GPU-based VM detection, dynamic API resolution, Donut shellcode via Thread Pool callbacks) at commodity scale, with 645+ unique DLL samples observed between Feb 28 and May 20, 2026.

How OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate works

OnionDrop is a multi-stage Windows loader tracked by the Cyderes Howler Cell Threat Research Team as the third documented component of a broader LegionLoader/CurlyGate operation that also includes the CGrabber infostealer and the Direct-Sys (APC injector) loader. Delivery occurs via ZIP archives that bundle a legitimate, Adobe-signed executable (setup.exe / AcroBroker.exe), two malicious DLLs (sqlite.dll and codecstore384d.dll), and a 100MB+ decoy data.bin file filled with random bytes to inflate archive size and frustrate automated scanning and upload limits.

Execution begins when AcroBroker.exe sideloads sqlite.dll, which on DLL_PROCESS_ATTACH uses LoadLibraryA to load codecstore384d.dll — the primary malicious DLL. codecstore384d.dll locates its encoded payload at a hardcoded offset (0xd9108 subtracted from the DLL file size) and runs a four-stage unpacking pipeline: (1) custom byte-pair decoding (stride 2) through a hardcoded 256-byte lookup table that maps the first byte to a high nibble and the second to a low nibble; (2) Xpress Huffman decompression via RtlDecompressBufferEx with COMPRESSION_FORMAT_XPRESS_HUFF, skipping a 0x3CDB-byte runtime offset, followed by a second byte-pair decode pass (stride 3); (3) AES-256-CBC decryption using rotating key material assembled incrementally via runtime XOR operations (one stage key: 27 2C 2A E0 E2 2F 8F 29 DC 43 F7 68 75 35 4D 83 37 7D 12 7A 67 0A 75 DA EF EF B3 A5 95 87 29 FE), with the first 16 bytes used as the IV and the remainder as ciphertext; and (4) execution of a Donut-generated shellcode payload, with the final PE decompressed via RtlDecompressBuffer using COMPRESSION_FORMAT_LZNT1.

Shellcode is mapped using native NTAPI (NtAllocateVirtualMemory, NtWriteVirtualMemory), with memory transitioned RW→RX via NtProtectVirtualMemory, and is executed by abusing the Windows Thread Pool callback API chain (TpAllocWork → TpPostWork → TpWaitForWork → TpReleaseWork) to avoid standard thread-creation telemetry. Where a direct thread is required, the loader uses NtCreateThreadEx to spawn its execution thread and returns from DllMain immediately, avoiding Loader Lock deadlock.

The loader employs extensive anti-analysis: GPU/VM detection via EnumDisplayDevicesA, comparing display-adapter strings with strstr against a decrypted whitelist (INTEL, GTX, ARC, AMD, RTX, QUADRO, RADEON, GEFORCE) and halting in unrecognized (virtualized) environments; dynamic API resolution via LdrGetProcedureAddress and LdrLoadDll (used to load bcrypt.dll for the BCrypt* decryption chain) to bypass hooked LoadLibrary/GetProcAddress; stack-string construction that builds sensitive symbol names (e.g., NtCreateThreadEx) character-by-character at runtime; rotating per-stage AES keys; and API hammering (flooding sandbox traces with irrelevant calls).

Delivered payloads evolved over the campaign: early February samples dropped the CGrabber infostealer, mid-campaign samples delivered LegionLoader/CurlyGate (RC4-decrypted configuration, callback to gainmsg[.]com/nfront.php over HTTPS using a Vivaldi-spoofing User-Agent), and the most recent samples delivered Vidar Stealer, sometimes through an intermediate Direct-Sys loader stage forming a five-stage chain. Cyderes characterizes the operator as a high-tempo threat actor running multiple infostealer operations simultaneously with nation-state-grade evasion architecture but commodity targeting at scale. There is no associated CVE; the threat is a delivery/evasion technique cluster with confirmed in-the-wild activity.

MITRE ATT&CK techniques used in TL-2026-0831

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1071 Application Layer Protocol; T1132 Data Encoding; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Execution

T1106 Native API; T1204 User Execution

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566 Phishing

stealth

T1574 Hijack Execution Flow

Affected products and versions in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

  • Microsoft — Windows
    Vulnerable versions: Windows 10 x64; Windows 11 x64; Windows Server
  • Adobe — Acrobat (AcroBroker.exe abused as signed sideloading host)
    Vulnerable versions: signed AcroBroker.exe binary abused for DLL side-loading

Remediation for OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

Immediate actions

  • Block gainmsg[.]com and the URL hxxps://gainmsg[.]com/nfront.php at proxy, DNS, and perimeter firewall
  • Add the nine published SHA256 hashes (ZIPs, DLL modules, OnionDrop loaders, CGrabber, LegionLoader, Vidar) to EDR/AV blocklists
  • Hunt for AcroBroker.exe / setup.exe loading non-Adobe-path sqlite.dll or codecstore384d.dll from user-writable directories
  • Quarantine ZIP archives containing an Adobe-signed EXE plus a 100MB+ data.bin filler file

Workarounds

  • Configure Safe DLL Search Mode and KnownDLLs to reduce sideloading surface
  • Restrict execution from %TEMP%, Downloads, and archive-extraction directories via AppLocker/WDAC

Longer-term hardening

  • Deploy EDR with behavioral detection for DLL side-loading from non-standard paths and Thread Pool (TpAllocWork/TpPostWork) shellcode execution
  • Enforce application allowlisting / WDAC so signed binaries can only load DLLs from their trusted install path
  • Enable script/attachment sandboxing and block password-protected or oversized archive delivery via email gateways
  • Monitor for NtCreateThreadEx and RW→RX NtProtectVirtualMemory sequences in unexpected processes

Weaknesses (CWE) in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

CWE-427, CWE-426, CWE-114

Timeline of OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

  • LegionLoader (aka Satacom/CurlyGate), the loader family whose ecosystem OnionDrop belongs to, is first identified in the wild (originally attributed by Mandiant); it later goes largely dormant.
  • LegionLoader/CurlyGate resurges in new distribution campaigns (fake-installer / paste-and-run delivery dropping a malicious Chrome extension and multiple stealers), per TEHTRIS and Italy's ACN advisories.
  • Earliest OnionDrop DLL sample observed via Cyderes YARA retro-hunting; campaign delivery begins, with early samples dropping the CGrabber infostealer.
  • Cyderes Howler Cell authors a YARA detection rule (metadata date 30-March-2026) covering the related Direct-Sys Loader / CGrabber chain that shares the OnionDrop tooling.
  • Cyderes publishes its analysis of the related Direct-Sys Loader and CGrabber five-stage malware chain from the same LegionLoader/CurlyGate ecosystem.
  • Most recent OnionDrop DLL sample observed; recent samples deliver Vidar Stealer, sometimes via an intermediate Direct-Sys loader stage forming a five-stage chain.
  • Cyderes Howler Cell publishes the OnionDrop analysis, reporting 645+ unique malicious DLL samples across the ~80-day window (Feb 28 - May 20, 2026) with delivery still active.
  • OnionDrop campaign covered by Cyber Security News, GBHackers, and Cyberpress, amplifying the gainmsg[.]com C2 and SHA256 IOCs to defenders.

Sources cited for OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

Threats related to OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate

Detection coverage for TL-2026-0831

As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0831 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats