Skip to navigation

Threat reportMalwareTL-2026-2612

Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems

mediumACTIVE

AhnLab ASEC confirmed on 2026-09-17 that the tracked threat cluster Larva-25012 resumed active proxyware distribution in H2 2026 by pivoting to systems already infected with the DPLoader downloader rather than opening new infection vectors. DPLoader (JavaScript and Python variants) beacons to cloud-hosted C2 infrastructure and pulls PowerShell scripts that silently register DigitalPulse, SOAX, Appsalt, and IPRoyal proxyware via Task Scheduler for bandwidth-hijacking (proxyjacking) monetization.

Key facts for Larva-25012 proxyware campaign

IdentifiersTL-2026-2612
SeverityMEDIUM
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows
AttributionLarva‑25012 (medium confidence)
MalwareDPLoader
ToolsAppsalt, DigitalPulse, Honeygain, IPRoyal, Infatica, SOAX
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036.005 Match Legitimate Resource Name or Location, T1053.005 Scheduled Task, T1055.001 Dynamic-link Library Injection, T1059.001 PowerShell, T1059.006 Python, T1059.007 JavaScript, T1071.001 Web Protocols, T1082 System Information Discovery, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1218.011 Rundll32 and 5 more in the attack flow
MotivationFINANCIAL
Target regionssouth korea
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Larva-25012 proxyware campaign

As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2612 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Scheduled Task Creation Matching Larva-25012 Proxyware Persistence Names

Detects Task Scheduler operational-log task registration events whose TaskName exactly matches one of the four persistence mechanisms Larva-25012 registers to relaunch DigitalPulse, SOAX, Appsalt, or IPRoyal proxyware after reboot.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1053.005, T1036.005
  • Data sources: windows_task_scheduler_operational_log
  • Severity: high
  • Confidence: high

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" EventCode=106
| eval known_task=if(match(lower(TaskName), "plutonagentscheduler") OR match(lower(TaskName), "enterprisemgmtservicesscheduler") OR match(lower(TaskName), "securityhealthservicesyncupdate") OR match(lower(TaskName), "backgroundtaskregistrationmaintenancetaskscheduler"), 1, 0)
| where known_task=1
| table _time, ComputerName, UserContext, TaskName, EventCode
| sort - _time

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields).TaskName)
| where TaskName has_any ("PlutonAgentScheduler","EnterpriseMgmtServicesScheduler","SecurityHealthServiceSyncUpdate","BackgroundTaskRegistrationMaintenanceTaskScheduler")
| project Timestamp, DeviceName, InitiatingProcessAccountName, TaskName, ActionType

Sigma

title: Scheduled Task Created Matching Larva-25012 Proxyware Persistence Names
id: 1e2d3c4b-5a69-4f78-9012-abcdef012345
status: experimental
description: Detects creation of a Windows Scheduled Task whose name matches one of the four persistence mechanisms Larva-25012 uses to relaunch DigitalPulse, SOAX, Appsalt, or IPRoyal proxyware.
references:
    - https://asec.ahnlab.com/en/95516/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: windows
    service: taskscheduler
detection:
    selection:
        EventID: 106
        TaskName|contains:
            - 'PlutonAgentScheduler'
            - 'EnterpriseMgmtServicesScheduler'
            - 'SecurityHealthServiceSyncUpdate'
            - 'BackgroundTaskRegistrationMaintenanceTaskScheduler'
    condition: selection
falsepositives:
    - None expected; these task names are attacker-chosen and not used by legitimate Microsoft or third-party software
level: high

Known false positives:

  • None expected; these task names are attacker-chosen and not used by legitimate Microsoft or third-party software

Tuning notes: Extend TaskName matching if the actor rotates naming conventions in future waves — prior campaigns used FastDiskCleanup, DefragDiskCleanup, and Network Performance; alert on TaskContentNew referencing the known install paths (plutonagent.exe, deephour.exe, copilotservice.exe, securityhealthservicesyncupdate.exe, TaskRegistrationMaintenance.exe) even if the TaskName itself changes.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Correlated PowerShell + Network Connection to Confirmed Larva-25012 Delivery Domains · unlock with TL Creds
  • Defender Real-Time Protection Tampering Co-occurring with Proxyware Install-Path Activity · unlock with TL Creds
  • High-Volume Outbound Connections from Larva-25012 Proxyware Binaries (Resource Hijacking) · unlock with TL Creds
  • DPLoader-Style PowerShell Downloader Retrieving Proxyware Installer Script · unlock with TL Creds
  • Process Execution from Larva-25012 Proxyware Masqueraded Install Paths · unlock with TL Creds
  • Rundll32-Loaded syncupdates.dll Preceding Explorer.exe Process Injection (DigitalPulse) · unlock with TL Creds
  • DPLoader-Stage PowerShell Beaconing to Abused AWS Lambda / CloudFront C2 · unlock with TL Creds
  • Rundll32 or Explorer Loading Larva-25012 Proxyware SDK DLLs (Process Injection / LOLBin Abuse) · unlock with TL Creds

Indicators of compromise for Larva-25012 proxyware campaign

As of 2026-09-22, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2612.

Sample indicators (3 of 26)

  • URL: hxxps://7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e
  • File hash: 0066422310c880d5e722ba59ad315df1
  • URL: hxxps://d36rb13t9es4g1[.]cloudfront[.]net/192837455732.ps1

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

How Larva-25012 proxyware campaign works

Larva-25012 is AhnLab ASEC's tracking designation for a financially motivated threat cluster that has distributed unwanted proxyware/bandwidth-sharing SDKs (DigitalPulse, Honeygain, Infatica, SOAX, Appsalt, IPRoyal) since at least 2024, primarily via pop-up ads on free YouTube-video-download sites, GitHub repositories disguised as a Steam cleanup tool, cracked-software portals, and (in a January 2026 wave) a fake Notepad++ installer. In its September 2026 report, ASEC documented that the actor did not need a new delivery vector for its latest wave: it simply leveraged the large existing population of Windows hosts already carrying DPLoader, a lightweight JavaScript/Python downloader that collects basic host information, periodically beacons it to command-and-control infrastructure, and executes PowerShell commands returned by the C2 server.

In the observed 2026-09 activity, DPLoader's C2/download infrastructure is hosted on abused cloud web services rather than dedicated attacker-owned servers: an AWS Lambda Function URL (7jb7qi6vnr5pa22a4br4irz3tu0yqzbd.lambda-url.us-east-1.on.aws) and multiple Amazon CloudFront distributions serve PowerShell downloader scripts, proxyware executables, and SDK DLLs. The downloaded PowerShell installs one or more proxyware packages, each wired into Windows Task Scheduler under a name designed to blend in with legitimate system/security tooling: DigitalPulse as "PlutonAgentScheduler" (dropping plutonagent.exe under %SystemRoot%\pluton\<random>\ and disabling Microsoft Defender), SOAX as "EnterpriseMgmtServicesScheduler" (an SDK DLL loader masquerading as deephour.exe or a fake copilotservice.exe under a spoofed Microsoft Copilot services path), Appsalt as "SecurityHealthServiceSyncUpdate" (an SDK DLL loader calling the exported appsalt_init() function from appsalt.dll, disguised as a Windows servicing binary), and IPRoyal as "BackgroundTaskRegistrationMaintenanceTaskScheduler" (loading the IPRoyal Pawns SDK via pawns-sdk.dll). Each proxyware package resells the infected host's internet bandwidth to the vendor's residential-proxy network, generating referral/usage revenue for the threat actor while the victim is unaware their connection is being resold.

This is a repeat pattern for the cluster: a 2023 LevelBlue report already tied an earlier DigitalPulse proxyjacking wave to over 400,000 infected Windows systems, and ASEC's own 2025-2026 reporting traces a consistent evolution of the same playbook — CloudFront-hosted JavaScript/PowerShell downloaders, Task Scheduler persistence under innocuous-sounding names ("DefragDiskCleanup", "FastDiskCleanup", "FastCleanPlus.exe", "Network Performance"), anti-VM/sandbox checks, abuse of code-signing certificates, and (in the January 2026 wave) direct DLL injection of a Go-based DigitalPulse payload into explorer.exe via a rundll32-loaded "syncupdates.dll" injector. AhnLab's "Larva-24011" designation is an unrelated cluster (MS-SQL/IIS server compromise, web shells, Gh0st RAT/AnyDesk, XMRig) that happens to share the sequential Larva-NNNNN naming scheme with no other overlap; it is noted here only to avoid conflating the two. There is no CVE or software vulnerability involved — the vector is unauthorized/unwanted-program installation via an existing malware foothold, not exploitation.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Dynamic-link Library Injection; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497.001 System Checks

Persistence

T1053.005 Scheduled Task

Execution

T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery

Impact

T1496 Resource Hijacking

defense-impairment

T1553.002 Code Signing; T1685 Disable or Modify Tools

Resource Development

T1583.006 Web Services

Remediation for Larva-25012 proxyware campaign

Immediate actions

  • Block the identified C2/download infrastructure (AWS Lambda Function URL and CloudFront domains) at the proxy/firewall/DNS layer
  • Hunt for and remove unauthorized Scheduled Task entries named PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate, and BackgroundTaskRegistrationMaintenanceTaskScheduler
  • Identify and isolate hosts already running DPLoader before a proxyware payload executes, since this campaign re-uses existing infections rather than a new delivery vector
  • Audit endpoints for unauthorized bandwidth-sharing/proxy processes (plutonagent.exe, deephour.exe, copilotservice.exe, securityhealthservicesyncupdate.exe, TaskRegistrationMaintenance.exe) and uninstall associated SDKs (DigitalPulse, SOAX, Appsalt, IPRoyal, Honeygain, Infatica)

Workarounds

  • Disable/delete any unrecognized Scheduled Task entries matching the naming patterns above pending full remediation
  • Verify Microsoft Defender real-time protection has not been silently disabled and re-enable if tampered with

Longer-term hardening

  • Deploy EDR with behavioral detection for Task Scheduler creation/modification and for LOLBins (rundll32.exe, PowerShell) loading unsigned DLLs
  • Restrict unsigned/unapproved PowerShell execution via Constrained Language Mode, AppLocker, or WDAC
  • Monitor and restrict outbound access to AWS Lambda Function URLs, Amazon CloudFront, and Cloudflare R2 endpoints not sanctioned for business use, since this actor consistently abuses trusted cloud CDNs for payload hosting
  • User awareness training on the risk of pirated/cracked software, YouTube-downloader ad pages, and fake tool installers (Notepad++, Steam cleanup utilities) as this cluster's historical initial-access vector

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server

Timeline of Larva-25012 proxyware campaign

  • LevelBlue publishes an earlier report tying a locked-ioc-19 proxyjacking wave to over 400,000 infected Windows systems, establishing the actor's long-running playbook.
  • ASEC reports locked-ioc-19 proxyware distributed through malicious ad pages using "FastDiskCleanup" and "Network Performance" Task Scheduler entries.
  • ASEC reports locked-ioc-19 and locked-ioc-21 proxyware distributed via pop-up ads on free YouTube video-download sites, with payloads hosted on Amazon CloudFront.
  • ASEC reports Larva-25012 distributing proxyware disguised as a Notepad++ installer; locked-ioc-19's Go-based payload is injected into explorer.exe via a rundll32-loaded "syncupdates.dll", and locked-ioc-23 is registered as "Microsoft Anti-Malware Tool".
  • AhnLab V3 publishes Downloader/PowerShell.Proxyware.SC316575 and initial Unwanted/Win.Proxyware.C5943232/C5943233/C5946331 signatures for the resumed campaign.
  • ASEC publishes "Larva-25012: A 2026 Proxyware Distribution Campaign," confirming the actor resumed distribution by pivoting to systems already infected with locked-ioc-22 rather than opening a new infection vector.
  • AhnLab V3 adds Trojan/Win.Loader.C5946067 and C5946330, plus Unwanted/Win.Proxyware.C5946068 and C5946328, covering additional locked-ioc-22/proxyware samples.
  • AhnLab V3 adds Downloader/PowerShell.Proxyware.SC316650, covering an updated PowerShell proxyware installer variant.
  • AhnLab V3 adds Trojan/Win.Loader.C5948027 and Unwanted/Win.Proxyware.C5948028, the most recent signatures observed for this campaign as of this research.

Sources cited for Larva-25012 proxyware campaign

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats