SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor
SynkLoader: Modular Multi-Language Loader Deployed via (TL-2026-2131) is a high-severity malware campaign, first published 2026-08-24. It has no confirmed attribution, affects Microsoft Windows (Active Directory-joined endpoints reachable via, maps to 19 MITRE ATT&CK techniques (T1018, T1021.005, T1027), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-2131
- Threat ID
- TL-2026-2131
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-24
- Last reviewed
- 2026-08-24
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in SynkLoader: Modular Multi-Language Loader Deployed via
Malware and tooling: SynkLoader, Interactive Shell, PhishLocker, StreamMaster, TrafficRedirector
Expel researcher Marcus Hutchins identified SynkLoader, a modular Python/PowerShell/C#/C++ malware toolkit delivered via Microsoft Teams messages impersonating an internal IT Service Desk. Victims are tricked into installing a fake 'PowerShell Cleaner' MSI from Azure Blob Storage that unpacks a fake Windows 11 lock screen credential-stealer, a PowerShell RAT, a VNC-style remote-control module (StreamMaster), and a reverse-proxy module (TrafficRedirector), then profiles the Active Directory environment in a way consistent with sizing a ransom demand.
How SynkLoader: Modular Multi-Language Loader Deployed via works
Expel discovered SynkLoader on 2026-08-18 after EDR flagged an anomalous COM-created scheduled task in a customer environment; file metadata and compile timestamps place the toolkit's first build and distribution around 2026-07-28. The attack begins with an operator impersonating a company's IT Service Desk over Microsoft Teams from an external Microsoft 365 tenant, directing the target to download and run an MSI installer disguised as a 'PowerShell Cleaner' utility and hosted on Microsoft Azure Blob Storage (filereserve.blob.core.windows[.]net) to lend it legitimacy.
The MSI drops an obfuscated PowerShell script (cleaner.ps1) that decodes and decrypts (Base64 / AES-CBC) further instructions in memory via nested Invoke-Expression calls, then extracts an archive (archive6.zip) containing a self-contained Python runtime into a randomly named directory under %AppData%. The environment launches a Python loader (ss.py) via pythonw.exe rather than a visible console, and drops decoy files named to mimic legitimate Microsoft Visual C++ runtime DLLs (msvcp150.dll, msvcp160.dll). Persistence is established by creating a randomly named scheduled task through the Windows Task Scheduler COM interface — rather than schtasks.exe — configured to relaunch the loader at user logon and daily at 10:00 local time, reducing command-line telemetry that behavioral detections typically key on.
Once resident, SynkLoader operates as a modular capability set: a System Profiler component enumerates hostname, username, privilege level, running processes, services, domain membership, and the count of Active Directory-joined computers; PhishLocker renders a full-screen GUI that mimics the Windows 11 lock screen to harvest the victim's password; an Interactive Shell module provides a PowerShell-based remote command channel (RAT); StreamMaster provides VNC-style desktop streaming with remote mouse/keyboard input; and TrafficRedirector turns the host into a reverse proxy, giving the operator a path into the internal corporate network or onward internet access through the victim's IP. A module-status script reports which components and threads are currently active. The loader checks in with hardcoded command-and-control domains roughly every 90-120 seconds, encrypting JSON tasking with a ChaCha20 stream cipher that uses non-standard ('modified Sigma') constants, and derives the per-victim encryption key from the randomly generated installation directory name — which also serves as a victim identifier.
Expel published indicators of compromise but cautioned that SynkLoader's module-level file hashes are regenerated per infection, making hash-based detection largely ineffective; defenders are pointed instead at the campaign's Teams-impersonation pretext, the Azure-hosted MSI delivery URL, the named C2 domains, and the COM-based scheduled-task persistence pattern. Hutchins assessed with low-to-medium confidence that SynkLoader is operated by a ransomware group or an initial access broker, based specifically on the toolkit's emphasis on counting AD-joined systems — a metric commonly used by ransomware operators to size a ransom demand — though no specific actor, ransomware family, or IAB brand has been attributed as of this writing.
MITRE ATT&CK techniques used in TL-2026-2131
Discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Persistence
Credential Access
Execution
T1059.001 PowerShell; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071 Application Layer Protocol; T1090.001 Internal Proxy; T1573.001 Symmetric Cryptography
stealth
T1218.007 Msiexec; T1684.001 Impersonation
Initial Access
Affected products and versions in SynkLoader: Modular Multi-Language Loader Deployed via
- Microsoft — Windows (Active Directory-joined endpoints reachable via Microsoft Teams)
Vulnerable versions: N/A - social-engineering delivery, not a software vulnerability
Remediation for SynkLoader: Modular Multi-Language Loader Deployed via
Patches
- No vendor patch applies — SynkLoader is delivered via social engineering and living-off-the-land technique abuse, not a software vulnerability
Immediate actions
- Block/monitor the identified SynkLoader C2 domains at DNS and perimeter proxy: neversoftmain[.]net, rootfarmapp[.]net, tripinupdate[.]net, dondermicapp[.]net, aroclenetapp[.]net
- Block or alert on downloads from the observed Azure Blob delivery path filereserve.blob.core.windows[.]net/vgnghuyk/
- Hunt EDR/Sysmon telemetry for scheduled tasks created via the Task Scheduler COM interface (not schtasks.exe) with randomized names, especially those triggering at logon and 10:00 local time
- Hunt for pythonw.exe spawning from randomly named directories under %AppData% and for msvcp150.dll/msvcp160.dll present outside legitimate Visual C++ redistributable install paths
- Alert on Microsoft Teams messages from external/guest tenants impersonating internal IT Service Desk roles, particularly those directing users to install software
Workarounds
- Restrict which users can install MSI packages from unmanaged/non-corporate Azure Blob or arbitrary internet sources (AppLocker/WDAC MSI publisher rules)
- Disable or restrict external tenant messaging in Microsoft Teams admin center for users not requiring cross-org collaboration
Longer-term hardening
- Restrict or tightly govern external-tenant chat/file-sharing in Microsoft Teams (disable external access or require admin allow-listing)
- Deploy EDR behavioral detections for in-memory PowerShell execution chains (Invoke-Expression from decoded/decrypted Base64 blobs) rather than relying on static signatures
- Deploy detections for anomalous ChaCha20/AES-encrypted beacon patterns with fixed 90-120s jitter windows to unfamiliar external domains
- Run user-awareness training specifically on IT-helpdesk impersonation delivered via collaboration platforms (Teams/Slack), not just email
Timeline of SynkLoader: Modular Multi-Language Loader Deployed via
- File metadata and compile timestamps indicate SynkLoader was first built and distribution infrastructure stood up around this date.
- Expel security researcher Marcus Hutchins begins technical analysis of the SynkLoader loader, its modules (PhishLocker, TrafficRedirector, StreamMaster, Interactive Shell), and its C2 protocol.
- Expel's EDR flags an anomalous COM-created scheduled task in a customer environment, triggering the investigation that uncovers SynkLoader.
- Dark Reading publishes 'Tricky SynkLoader Multitool May Herald Ransomware', covering the researcher's ransomware/IAB assessment.
- BleepingComputer publishes coverage of the SynkLoader Microsoft Teams phishing campaign, citing Expel's findings.
- Expel publishes its research blog on SynkLoader ('when you throw in everything but the kitchen sink'), including IOCs and the assessment that module hashes are unique per infection.
- Additional security-media outlets (The Hacker News, GBHackers, Cyber Press, CyberSecurityNews, dev.to, News4Hackers) republish and expand on the SynkLoader technical details, including the named C2 domains and file names.
Sources cited for SynkLoader: Modular Multi-Language Loader Deployed via
- New SynkLoader malware pushed in Microsoft Teams phishing campaign
- Tricky 'SynkLoader' Multitool May Herald Ransomware
- SynkLoader: when you throw in everything but the kitchen sink
- WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
- Microsoft Teams Phishing Deploys New SynkLoader Malware to Steal Windows Passwords
- New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks
- SynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows Passwords
- SynkLoader Deploying Multi-Stage Modules via Teams Phishing
- SynkLoader Malware Targets Corporate Networks with Password Theft and Remote Access
Threats related to SynkLoader: Modular Multi-Language Loader Deployed via
- SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting Enterprise Active Directory Environments
- Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
Detection coverage for TL-2026-2131
As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2131 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.