OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate, CGrabber, and Vidar via DLL Sideloading and gainmsg[.]com C2
OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate (TL-2026-0831), also tracked as OnionDrop, is a high-severity malware campaign, first published 2026-06-17. It is attributed to OnionDrop operator with low confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-0831
- Threat ID
- TL-2026-0831
- Also known as
- OnionDrop, OnionDrop Loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution
- OnionDrop operator
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- broad/opportunistic, consumer, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
Malware and tooling: OnionDrop, LegionLoader / CurlyGate
OnionDrop is an actively-delivered, payload-agnostic Windows malware loader (part of the LegionLoader/CurlyGate ecosystem documented by Cyderes' Howler Cell) that abuses DLL sideloading of an Adobe-signed AcroBroker.exe to execute a four-stage unpacking pipeline and deliver CGrabber, LegionLoader, and Vidar infostealers. It calls back to gainmsg[.]com/nfront.php and combines nation-state-grade evasion (GPU-based VM detection, dynamic API resolution, Donut shellcode via Thread Pool callbacks) at commodity scale, with 645+ unique DLL samples observed between Feb 28 and May 20, 2026.
How OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate works
OnionDrop is a multi-stage Windows loader tracked by the Cyderes Howler Cell Threat Research Team as the third documented component of a broader LegionLoader/CurlyGate operation that also includes the CGrabber infostealer and the Direct-Sys (APC injector) loader. Delivery occurs via ZIP archives that bundle a legitimate, Adobe-signed executable (setup.exe / AcroBroker.exe), two malicious DLLs (sqlite.dll and codecstore384d.dll), and a 100MB+ decoy data.bin file filled with random bytes to inflate archive size and frustrate automated scanning and upload limits.
Execution begins when AcroBroker.exe sideloads sqlite.dll, which on DLL_PROCESS_ATTACH uses LoadLibraryA to load codecstore384d.dll — the primary malicious DLL. codecstore384d.dll locates its encoded payload at a hardcoded offset (0xd9108 subtracted from the DLL file size) and runs a four-stage unpacking pipeline: (1) custom byte-pair decoding (stride 2) through a hardcoded 256-byte lookup table that maps the first byte to a high nibble and the second to a low nibble; (2) Xpress Huffman decompression via RtlDecompressBufferEx with COMPRESSION_FORMAT_XPRESS_HUFF, skipping a 0x3CDB-byte runtime offset, followed by a second byte-pair decode pass (stride 3); (3) AES-256-CBC decryption using rotating key material assembled incrementally via runtime XOR operations (one stage key: 27 2C 2A E0 E2 2F 8F 29 DC 43 F7 68 75 35 4D 83 37 7D 12 7A 67 0A 75 DA EF EF B3 A5 95 87 29 FE), with the first 16 bytes used as the IV and the remainder as ciphertext; and (4) execution of a Donut-generated shellcode payload, with the final PE decompressed via RtlDecompressBuffer using COMPRESSION_FORMAT_LZNT1.
Shellcode is mapped using native NTAPI (NtAllocateVirtualMemory, NtWriteVirtualMemory), with memory transitioned RW→RX via NtProtectVirtualMemory, and is executed by abusing the Windows Thread Pool callback API chain (TpAllocWork → TpPostWork → TpWaitForWork → TpReleaseWork) to avoid standard thread-creation telemetry. Where a direct thread is required, the loader uses NtCreateThreadEx to spawn its execution thread and returns from DllMain immediately, avoiding Loader Lock deadlock.
The loader employs extensive anti-analysis: GPU/VM detection via EnumDisplayDevicesA, comparing display-adapter strings with strstr against a decrypted whitelist (INTEL, GTX, ARC, AMD, RTX, QUADRO, RADEON, GEFORCE) and halting in unrecognized (virtualized) environments; dynamic API resolution via LdrGetProcedureAddress and LdrLoadDll (used to load bcrypt.dll for the BCrypt* decryption chain) to bypass hooked LoadLibrary/GetProcAddress; stack-string construction that builds sensitive symbol names (e.g., NtCreateThreadEx) character-by-character at runtime; rotating per-stage AES keys; and API hammering (flooding sandbox traces with irrelevant calls).
Delivered payloads evolved over the campaign: early February samples dropped the CGrabber infostealer, mid-campaign samples delivered LegionLoader/CurlyGate (RC4-decrypted configuration, callback to gainmsg[.]com/nfront.php over HTTPS using a Vivaldi-spoofing User-Agent), and the most recent samples delivered Vidar Stealer, sometimes through an intermediate Direct-Sys loader stage forming a five-stage chain. Cyderes characterizes the operator as a high-tempo threat actor running multiple infostealer operations simultaneously with nation-state-grade evasion architecture but commodity targeting at scale. There is no associated CVE; the threat is a delivery/evasion technique cluster with confirmed in-the-wild activity.
MITRE ATT&CK techniques used in TL-2026-0831
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Command and Control
T1071 Application Layer Protocol; T1132 Data Encoding; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion
Execution
T1106 Native API; T1204 User Execution
Credential Access
T1555 Credentials from Password Stores
Initial Access
stealth
Affected products and versions in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
- Microsoft — Windows
Vulnerable versions: Windows 10 x64; Windows 11 x64; Windows Server - Adobe — Acrobat (AcroBroker.exe abused as signed sideloading host)
Vulnerable versions: signed AcroBroker.exe binary abused for DLL side-loading
Remediation for OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
Immediate actions
- Block gainmsg[.]com and the URL hxxps://gainmsg[.]com/nfront.php at proxy, DNS, and perimeter firewall
- Add the nine published SHA256 hashes (ZIPs, DLL modules, OnionDrop loaders, CGrabber, LegionLoader, Vidar) to EDR/AV blocklists
- Hunt for AcroBroker.exe / setup.exe loading non-Adobe-path sqlite.dll or codecstore384d.dll from user-writable directories
- Quarantine ZIP archives containing an Adobe-signed EXE plus a 100MB+ data.bin filler file
Workarounds
- Configure Safe DLL Search Mode and KnownDLLs to reduce sideloading surface
- Restrict execution from %TEMP%, Downloads, and archive-extraction directories via AppLocker/WDAC
Longer-term hardening
- Deploy EDR with behavioral detection for DLL side-loading from non-standard paths and Thread Pool (TpAllocWork/TpPostWork) shellcode execution
- Enforce application allowlisting / WDAC so signed binaries can only load DLLs from their trusted install path
- Enable script/attachment sandboxing and block password-protected or oversized archive delivery via email gateways
- Monitor for NtCreateThreadEx and RW→RX NtProtectVirtualMemory sequences in unexpected processes
Weaknesses (CWE) in OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
CWE-427, CWE-426, CWE-114
Timeline of OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
- LegionLoader (aka Satacom/CurlyGate), the loader family whose ecosystem OnionDrop belongs to, is first identified in the wild (originally attributed by Mandiant); it later goes largely dormant.
- LegionLoader/CurlyGate resurges in new distribution campaigns (fake-installer / paste-and-run delivery dropping a malicious Chrome extension and multiple stealers), per TEHTRIS and Italy's ACN advisories.
- Earliest OnionDrop DLL sample observed via Cyderes YARA retro-hunting; campaign delivery begins, with early samples dropping the CGrabber infostealer.
- Cyderes Howler Cell authors a YARA detection rule (metadata date 30-March-2026) covering the related Direct-Sys Loader / CGrabber chain that shares the OnionDrop tooling.
- Cyderes publishes its analysis of the related Direct-Sys Loader and CGrabber five-stage malware chain from the same LegionLoader/CurlyGate ecosystem.
- Most recent OnionDrop DLL sample observed; recent samples deliver Vidar Stealer, sometimes via an intermediate Direct-Sys loader stage forming a five-stage chain.
- Cyderes Howler Cell publishes the OnionDrop analysis, reporting 645+ unique malicious DLL samples across the ~80-day window (Feb 28 - May 20, 2026) with delivery still active.
- OnionDrop campaign covered by Cyber Security News, GBHackers, and Cyberpress, amplifying the gainmsg[.]com C2 and SHA256 IOCs to defenders.
Sources cited for OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
- OnionDrop: Commoditized Loader with Nation-State-Grade Evasion
- New OnionDrop Loader Campaign Uses gainmsg C2 to Deliver LegionLoader Payloads
- Hackers Use OnionDrop Loader With DLL Sideloading to Deploy Multiple Infostealers
- OnionDrop Loader Uses Nation-State-Grade Evasion to Deliver LegionLoader, CGrabber, and Vidar
- Direct-Sys Loader and CGrabber Stealer Five-Stage Malware Chain
- OnionDrop: Commoditized Loader with Nation-State-Grade Evasion (Malware.news mirror)
- LegionLoader exposed - TEHTRIS
- LegionLoader: New distribution campaign detected - ACN (Italy CERT)
- From Fake Installers to Stolen Credentials: Decoding the LegionLoader Threat
Threats related to OnionDrop Loader Campaign Delivers LegionLoader/CurlyGate
- MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading
- TCLBANKER Brazilian Banking Trojan — Trojanized Logi AI Prompt Builder DLL Sideload with WhatsApp and Outlook Worm Modules (REF3076)
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
Detection coverage for TL-2026-0831
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0831 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.