SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting Enterprise Active Directory Environments
SynkLoader: New Multi-Module Malware Family Distributed via (TL-2026-2098), also tracked as Sink Loader, is a high-severity malware campaign, first published 2026-08-21. It has no confirmed attribution, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1007, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2098
- Threat ID
- TL-2026-2098
- Also known as
- Sink Loader
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-21
- Last reviewed
- 2026-08-21
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, technology, finance, health, government administration, manufacturing, education
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in SynkLoader: New Multi-Module Malware Family Distributed via
Malware and tooling: RemoteControl, Custom ChaCha20 encryption (modified Sigma)
SynkLoader is a previously undocumented multi-module malware family discovered by Expel's SOC in August 2026, distributed via Microsoft Teams phishing impersonating corporate IT help desks. Victims are directed to install a fake 'PowerShell Cleaner' MSI hosted on Azure Blob Storage. The malware includes modules for system profiling, credential theft via a fake Windows lock screen (PhishLocker), reverse proxy tunneling (TrafficRedirector), live desktop streaming/control (StreamMaster), and remote PowerShell execution. Expel assesses with low-medium confidence that SynkLoader is associated with ransomware operations based on its focus on Active Directory environment sizing.
How SynkLoader: New Multi-Module Malware Family Distributed via works
SynkLoader (pronounced 'Sink Loader') is a novel, modular malware family discovered by Expel's Security Operations Center (SOC) on August 18, 2026, during an incident response investigation on a client network. Named for its 'everything but the kitchen sink' approach, SynkLoader is unusually complex — bridging Python, PowerShell, C#, and C++ components across its module chain, with some modules using up to three programming languages simultaneously to evade signature-based detection.
Initial access is achieved through Microsoft Teams spearphishing: an attacker poses as the target company's IT help desk, using a @.onmicrosoft.com email address for legitimacy, and convinces the victim to download an MSI installer from Azure Blob Storage. The MSI, named 'PowershellCleaner' and hosted at filereserve.blob.core.windows.net/vgnghuyk/331/331.msi, extracts a PowerShell script (cleaner.ps1) and a ZIP archive (archive6.zip) containing a self-contained Python environment, precompiled libraries, and malicious DLLs masquerading as Microsoft Visual C++ runtime libraries (msvcp150.dll, msvcp160.dll).
The infection chain executes entirely in memory after initial extraction: cleaner.ps1 uses hex-encoded characters reconstructed via -join [char[]] and executed via iex, which decrypts an AES-CBC-encrypted blob to a script that extracts the Python environment to a random 16-character directory under %AppData% and launches ss.py via pythonw.exe. The Python main loader implements custom ChaCha20 encryption with modified Sigma constants ('mlswgtppayebtezk' and 'lwifnrfiosmfrubf') and beacons to one of three hardcoded C2 domains (neversoftmain.net, rootfarmapp.net, tripinupdate.net) on 90-120 second intervals, receiving Python code for in-memory execution via exec().
Expel's analysis — conducted by renowned researcher Marcus Hutchins (famous for stopping the WannaCry outbreak) — identified six primary modules plus a status reporting component. The System Profiler collects hostname, username, privilege level, running processes, services, and Active Directory domain details including computer count. The Persistence Module creates a randomly-named 12-character scheduled task via COM interfaces (CLSID_TaskScheduler, avoiding schtasks.exe detection) that triggers at user logon and daily at 10:00 AM. PhishLocker displays a highly convincing full-screen Windows 11 fake lock screen that captures the victim's Windows login password in plaintext without any validation. TrafficRedirector establishes a reverse proxy tunnel enabling attackers to route traffic through the victim's machine, bypassing IP allow-lists and accessing internal network resources. StreamMaster provides a Python-based VNC server that streams compressed desktop screenshots and accepts mouse/keyboard input (notably in the active user session, not a hidden desktop). The Interactive Shell module enables real-time remote PowerShell command execution.
Expel set up a honeypot that reverse-engineered the C2 protocol and emulated a large corporate Active Directory environment. After approximately 12 hours of waiting, the threat actors engaged in hands-on-keyboard activity around 8 AM PST, deploying additional modules including TrafficRedirector and the Interactive Shell before detecting the deception and disconnecting. Based on SynkLoader's focus on measuring Active Directory environment size (a metric primarily of interest to ransomware groups for ransom calculation), Expel assesses with low-to-medium confidence that the toolkit belongs to a ransomware operation or an initial access broker (IAB) selling access to ransomware affiliates. No specific threat actor group has been formally attributed.
The malware was first compiled around July 28, 2026 (msvcp150.dll compile timestamp: 8:02:11 AM), with campaign distribution occurring from roughly July 28 through mid-August 2026. The developer's PDB paths (C:\Users\genry\source\repos\) and extensive, well-formatted code comments in the StreamMaster module suggest AI-assisted ('vibe-coded') development. Static file hashes are unique per infection and unreliable for detection; behavioral detection based on the infection chain and C2 infrastructure is recommended.
MITRE ATT&CK techniques used in TL-2026-2098
Discovery
T1007 System Service Discovery; T1057 Process Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling; T1573 Encrypted Channel
execution
Privilege Escalation
T1547 Boot or Logon Autostart Execution
Initial Access
Affected products and versions in SynkLoader: New Multi-Module Malware Family Distributed via
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Microsoft — Microsoft Teams
Vulnerable versions: All versions (external messaging enabled) - Microsoft — Azure Blob Storage
Vulnerable versions: All versions (abused for hosting)
Remediation for SynkLoader: New Multi-Module Malware Family Distributed via
Immediate actions
- Block C2 domains (neversoftmain.net, rootfarmapp.net, tripinupdate.net, dondermicapp.net, aroclenetapp.net) at network perimeter and DNS filtering layers
- Block Azure Blob Storage URLs matching filereserve.blob.core.windows.net/vgnghuyk/ pattern
- Configure Microsoft Teams to restrict external chat and file transfers from untrusted tenants
- Deploy EDR rules to detect pythonw.exe executing from %AppData%\Roaming\<random>\fl\ang\ paths
- Alert on COM-based scheduled task creation without schtasks.exe process (CLSID_TaskScheduler usage)
- Block MSI files downloaded from Azure Blob Storage that are not from approved corporate distribution points
- Scan endpoints for the known scheduled task patterns (random 12-char names, daily 10:00 AM trigger running pythonw.exe)
Workarounds
- Configure Teams external access settings to block or flag messages from external @.onmicrosoft.com accounts
- Restrict Python interpreter execution (python.exe, pythonw.exe) to approved directories via AppLocker or WDAC
- Enable PowerShell ScriptBlock logging and AMSI to catch the hex-encoded deobfuscation chain
- Monitor for msvcp150.dll and msvcp160.dll loaded from non-standard paths (not C:\Windows\System32\)
Longer-term hardening
- Implement application control policies (WDAC/AppLocker) to restrict MSI execution and Python interpreters from non-standard paths
- Deploy network detection rules for custom ChaCha40 traffic (modified Sigma values 'mlswgtppayebtezk' and 'lwifnrfiosmfrubf') as encryption layer fingerprint
- Establish user awareness training specifically for Teams-based help desk impersonation and unsolicited MSI installation requests
- Implement behavioral detection for full-screen borderless GUI applications that mimic system lock screens (visible in Alt+Tab)
- Monitor for hidden PowerShell windows with hex-to-string-to-iex encoding chains as initial compromise indicator
- Deploy YARA rules targeting msvcp150.dll export signatures (RunPowerShell, RunPowerShellW) and msvcp160.dll manual DLL mapping behavior
Timeline of SynkLoader: New Multi-Module Malware Family Distributed via
- Microsoft publishes advisory on Storm-0324 using Teams phishing with TeamsPhisher tool to deliver payloads including JSSLoader, Gozi, and Nymaim, often leading to ransomware deployment — establishing the TTP pattern later used by SynkLoader
- SynkLoader campaign begins distribution; MSI installer (331.msi) hosted on Azure Blob Storage at filereserve.blob.core.windows.net/vgnghuyk/331/331.msi, disguised as 'PowershellCleaner' tool
- SynkLoader persistence module DLL compiled (schdtaks_atlg_dll); PDB path: C:\Users\genry\source\repos\schdtaks_atlg_dll\x64\Release\schdtaks_atlg_dll.pdb
- SynkLoader components first compiled: msvcp150.dll (PowerShell executor DLL) compile timestamp 8:02:11 AM; developer PDB path: C:\Users\genry\source\repos\pwshnewdll\x64\Release\pwshnewdll.pdb
- Expel SOC discovers SynkLoader during incident response investigation on a client network; initial detection triggered by EDR alert on a suspicious randomly-named scheduled task
- Threat actors engage in hands-on-keyboard attack against Expel honeypot (~8:00 AM PST); deploy TrafficRedirector, Interactive Shell, and StreamMaster modules; run profiling commands before detecting honeypot and disconnecting
- Expel deploys C2 protocol emulator honeypot posing as a large corporate Active Directory environment with thousands of systems; waits ~12 hours for adversary engagement
- Expel publishes full technical analysis of SynkLoader by Marcus Hutchins: 'SynkLoader: When you throw in everything but the kitchen sink'
- SynkLoader C2 domains (neversoftmain.net, rootfarmapp.net, tripinupdate.net, dondermicapp.net, aroclenetapp.net) ingested into automated threat intelligence feeds including C2IntelFeeds for defensive blocking
- CyberInsider publishes additional analysis: 'New SynkLoader malware uses fake Windows lock screen to steal passwords'
- BleepingComputer publishes news coverage: 'New SynkLoader malware pushed in Microsoft Teams phishing campaign'
Sources cited for SynkLoader: New Multi-Module Malware Family Distributed via
- SynkLoader: When you throw in everything but the kitchen sink
- New SynkLoader malware pushed in Microsoft Teams phishing campaign
- New SynkLoader malware uses fake Windows lock screen to steal passwords
- Microsoft: Teams phishing used in multi-stage attacks
- C2IntelFeeds: SynkLoader domains
- Cross-tenant helpdesk impersonation to data exfiltration — human-operated intrusion playbook
- Increase in email bombing and IT impersonation campaigns via Microsoft Teams
- Chaos in Teams — vishing campaign deploying custom loader and Chaos ransomware
Threats related to SynkLoader: New Multi-Module Malware Family Distributed via
- SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor
- Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access
- Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation
Detection coverage for TL-2026-2098
As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2098 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.