# SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting Enterprise Active Directory Environments

> SynkLoader is a previously undocumented multi-module malware family discovered by Expel's SOC in August 2026, distributed via Microsoft Teams phishing impersonating corporate IT help desks. Victims are directed to install a fake 'PowerShell Cleaner' MSI hosted on Azure Blob Storage. The malware includes modules for system profiling, credential theft via a fake Windows lock screen (PhishLocker), reverse proxy tunneling (TrafficRedirector), live desktop streaming/control (StreamMaster), and remote PowerShell execution. Expel assesses with low-medium confidence that SynkLoader is associated with ransomware operations based on its focus on Active Directory environment sizing.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2098
- **ID:** TL-2026-2098
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SynkLoader (pronounced 'Sink Loader') is a novel, modular malware family discovered by Expel's Security Operations Center (SOC) on August 18, 2026, during an incident response investigation on a client network. Named for its 'everything but the kitchen sink' approach, SynkLoader is unusually complex — bridging Python, PowerShell, C#, and C++ components across its module chain, with some modules using up to three programming languages simultaneously to evade signature-based detection.

Initial access is achieved through Microsoft Teams spearphishing: an attacker poses as the target company's IT help desk, using a @.onmicrosoft.com email address for legitimacy, and convinces the victim to download an MSI installer from Azure Blob Storage. The MSI, named 'PowershellCleaner' and hosted at filereserve.blob.core.windows.net/vgnghuyk/331/331.msi, extracts a PowerShell script (cleaner.ps1) and a ZIP archive (archive6.zip) containing a self-contained Python environment, precompiled libraries, and malicious DLLs masquerading as Microsoft Visual C++ runtime libraries (msvcp150.dll, msvcp160.dll).

The infection chain executes entirely in memory after initial extraction: cleaner.ps1 uses hex-encoded characters reconstructed via -join [char[]] and executed via iex, which decrypts an AES-CBC-encrypted blob to a script that extracts the Python environment to a random 16-character directory under %AppData% and launches ss.py via pythonw.exe. The Python main loader implements custom ChaCha20 encryption with modified Sigma constants ('mlswgtppayebtezk' and 'lwifnrfiosmfrubf') and beacons to one of three hardcoded C2 domains (neversoftmain.net, rootfarmapp.net, tripinupdate.net) on 90-120 second intervals, receiving Python code for in-memory execution via exec().

Expel's analysis — conducted by renowned researcher Marcus Hutchins (famous for stopping the WannaCry outbreak) — identified six primary modules plus a status reporting component. The System Profiler collects hostname, username, privilege level, running processes, services, and Active Directory domain details including computer count. The Persistence Module creates a randomly-named 12-character scheduled task via COM interfaces (CLSID_TaskScheduler, avoiding schtasks.exe detection) that triggers at user logon and daily at 10:00 AM. PhishLocker displays a highly convincing full-screen Windows 11 fake lock screen that captures the victim's Windows login password in plaintext without any validation. TrafficRedirector establishes a reverse proxy tunnel enabling attackers to route traffic through the victim's machine, bypassing IP allow-lists and accessing internal network resources. StreamMaster provides a Python-based VNC server that streams compressed desktop screenshots and accepts mouse/keyboard input (notably in the active user session, not a hidden desktop). The Interactive Shell module enables real-time remote PowerShell command execution.

Expel set up a honeypot that reverse-engineered the C2 protocol and emulated a large corporate Active Directory environment. After approximately 12 hours of waiting, the threat actors engaged in hands-on-keyboard activity around 8 AM PST, deploying additional modules including TrafficRedirector and the Interactive Shell before detecting the deception and disconnecting. Based on SynkLoader's focus on measuring Active Directory environment size (a metric primarily of interest to ransomware groups for ransom calculation), Expel assesses with low-to-medium confidence that the toolkit belongs to a ransomware operation or an initial access broker (IAB) selling access to ransomware affiliates. No specific threat actor group has been formally attributed.

The malware was first compiled around July 28, 2026 (msvcp150.dll compile timestamp: 8:02:11 AM), with campaign distribution occurring from roughly July 28 through mid-August 2026. The developer's PDB paths (C:\Users\genry\source\repos\) and extensive, well-formatted code comments in the StreamMaster module suggest AI-assisted ('vibe-coded') development. Static file hashes are unique per infection and unreliable for detection; behavioral detection based on the infection chain and C2 infrastructure is recommended.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1106 Native API
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1007 System Service Discovery
- T1071 Application Layer Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1573 Encrypted Channel

## Sources

- [SynkLoader: When you throw in everything but the kitchen sink](https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/)
- [New SynkLoader malware pushed in Microsoft Teams phishing campaign](https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/)
- [New SynkLoader malware uses fake Windows lock screen to steal passwords](https://cyberinsider.com/new-synkloader-malware-uses-fake-windows-lock-screen-to-steal-passwords/)
- [Microsoft: Teams phishing used in multi-stage attacks](https://www.microsoft.com/en-us/security/blog/2023/09/25/storm-0324-teams-phishing-and-journey-to-ransomware/)
- [C2IntelFeeds: SynkLoader domains](https://github.com/drb-ra/C2IntelFeeds/)
- [Cross-tenant helpdesk impersonation to data exfiltration — human-operated intrusion playbook](https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/)
- [Increase in email bombing and IT impersonation campaigns via Microsoft Teams](https://www.esentire.com/security-advisories/increase-in-email-bombing-and-it-impersonation-campaigns)
- [Chaos in Teams — vishing campaign deploying custom loader and Chaos ransomware](https://www.sophos.com/en-us/blog/chaos-in-teams-vishing)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2098