Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
Larva-25012 Resumes Proxyware Distribution Campaign via (TL-2026-2612) is a medium-severity malware campaign, first published 2026-09-22. It is attributed to Larva‑25012 with medium confidence, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-2612
- Threat ID
- TL-2026-2612
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-22
- Last reviewed
- 2026-09-22
- Attribution
- Larva‑25012
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Larva-25012 Resumes Proxyware Distribution Campaign via
Malware and tooling: DPLoader, Appsalt, DigitalPulse, Honeygain, IPRoyal, Infatica, SOAX
AhnLab ASEC confirmed on 2026-09-17 that the tracked threat cluster Larva-25012 resumed active proxyware distribution in H2 2026 by pivoting to systems already infected with the DPLoader downloader rather than opening new infection vectors. DPLoader (JavaScript and Python variants) beacons to cloud-hosted C2 infrastructure and pulls PowerShell scripts that silently register DigitalPulse, SOAX, Appsalt, and IPRoyal proxyware via Task Scheduler for bandwidth-hijacking (proxyjacking) monetization.
How Larva-25012 Resumes Proxyware Distribution Campaign via works
Larva-25012 is AhnLab ASEC's tracking designation for a financially motivated threat cluster that has distributed unwanted proxyware/bandwidth-sharing SDKs (DigitalPulse, Honeygain, Infatica, SOAX, Appsalt, IPRoyal) since at least 2024, primarily via pop-up ads on free YouTube-video-download sites, GitHub repositories disguised as a Steam cleanup tool, cracked-software portals, and (in a January 2026 wave) a fake Notepad++ installer. In its September 2026 report, ASEC documented that the actor did not need a new delivery vector for its latest wave: it simply leveraged the large existing population of Windows hosts already carrying DPLoader, a lightweight JavaScript/Python downloader that collects basic host information, periodically beacons it to command-and-control infrastructure, and executes PowerShell commands returned by the C2 server.
In the observed 2026-09 activity, DPLoader's C2/download infrastructure is hosted on abused cloud web services rather than dedicated attacker-owned servers: an AWS Lambda Function URL (7jb7qi6vnr5pa22a4br4irz3tu0yqzbd.lambda-url.us-east-1.on.aws) and multiple Amazon CloudFront distributions serve PowerShell downloader scripts, proxyware executables, and SDK DLLs. The downloaded PowerShell installs one or more proxyware packages, each wired into Windows Task Scheduler under a name designed to blend in with legitimate system/security tooling: DigitalPulse as "PlutonAgentScheduler" (dropping plutonagent.exe under %SystemRoot%\pluton\<random>\ and disabling Microsoft Defender), SOAX as "EnterpriseMgmtServicesScheduler" (an SDK DLL loader masquerading as deephour.exe or a fake copilotservice.exe under a spoofed Microsoft Copilot services path), Appsalt as "SecurityHealthServiceSyncUpdate" (an SDK DLL loader calling the exported appsalt_init() function from appsalt.dll, disguised as a Windows servicing binary), and IPRoyal as "BackgroundTaskRegistrationMaintenanceTaskScheduler" (loading the IPRoyal Pawns SDK via pawns-sdk.dll). Each proxyware package resells the infected host's internet bandwidth to the vendor's residential-proxy network, generating referral/usage revenue for the threat actor while the victim is unaware their connection is being resold.
This is a repeat pattern for the cluster: a 2023 LevelBlue report already tied an earlier DigitalPulse proxyjacking wave to over 400,000 infected Windows systems, and ASEC's own 2025-2026 reporting traces a consistent evolution of the same playbook — CloudFront-hosted JavaScript/PowerShell downloaders, Task Scheduler persistence under innocuous-sounding names ("DefragDiskCleanup", "FastDiskCleanup", "FastCleanPlus.exe", "Network Performance"), anti-VM/sandbox checks, abuse of code-signing certificates, and (in the January 2026 wave) direct DLL injection of a Go-based DigitalPulse payload into explorer.exe via a rundll32-loaded "syncupdates.dll" injector. AhnLab's "Larva-24011" designation is an unrelated cluster (MS-SQL/IIS server compromise, web shells, Gh0st RAT/AnyDesk, XMRig) that happens to share the sequential Larva-NNNNN naming scheme with no other overlap; it is noted here only to avoid conflating the two. There is no CVE or software vulnerability involved — the vector is unauthorized/unwanted-program installation via an existing malware foothold, not exploitation.
MITRE ATT&CK techniques used in TL-2026-2612
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Dynamic-link Library Injection; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1497.001 System Checks
Persistence
Execution
T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Discovery
T1082 System Information Discovery
Impact
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Resource Development
Affected products and versions in Larva-25012 Resumes Proxyware Distribution Campaign via
- Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server
Remediation for Larva-25012 Resumes Proxyware Distribution Campaign via
Immediate actions
- Block the identified C2/download infrastructure (AWS Lambda Function URL and CloudFront domains) at the proxy/firewall/DNS layer
- Hunt for and remove unauthorized Scheduled Task entries named PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate, and BackgroundTaskRegistrationMaintenanceTaskScheduler
- Identify and isolate hosts already running DPLoader before a proxyware payload executes, since this campaign re-uses existing infections rather than a new delivery vector
- Audit endpoints for unauthorized bandwidth-sharing/proxy processes (plutonagent.exe, deephour.exe, copilotservice.exe, securityhealthservicesyncupdate.exe, TaskRegistrationMaintenance.exe) and uninstall associated SDKs (DigitalPulse, SOAX, Appsalt, IPRoyal, Honeygain, Infatica)
Workarounds
- Disable/delete any unrecognized Scheduled Task entries matching the naming patterns above pending full remediation
- Verify Microsoft Defender real-time protection has not been silently disabled and re-enable if tampered with
Longer-term hardening
- Deploy EDR with behavioral detection for Task Scheduler creation/modification and for LOLBins (rundll32.exe, PowerShell) loading unsigned DLLs
- Restrict unsigned/unapproved PowerShell execution via Constrained Language Mode, AppLocker, or WDAC
- Monitor and restrict outbound access to AWS Lambda Function URLs, Amazon CloudFront, and Cloudflare R2 endpoints not sanctioned for business use, since this actor consistently abuses trusted cloud CDNs for payload hosting
- User awareness training on the risk of pirated/cracked software, YouTube-downloader ad pages, and fake tool installers (Notepad++, Steam cleanup utilities) as this cluster's historical initial-access vector
Timeline of Larva-25012 Resumes Proxyware Distribution Campaign via
- LevelBlue publishes an earlier report tying a DigitalPulse proxyjacking wave to over 400,000 infected Windows systems, establishing the actor's long-running playbook.
- ASEC reports DigitalPulse proxyware distributed through malicious ad pages using "FastDiskCleanup" and "Network Performance" Task Scheduler entries.
- ASEC reports DigitalPulse and Honeygain proxyware distributed via pop-up ads on free YouTube video-download sites, with payloads hosted on Amazon CloudFront.
- ASEC reports Larva-25012 distributing proxyware disguised as a Notepad++ installer; DigitalPulse's Go-based payload is injected into explorer.exe via a rundll32-loaded "syncupdates.dll", and Infatica is registered as "Microsoft Anti-Malware Tool".
- AhnLab V3 publishes Downloader/PowerShell.Proxyware.SC316575 and initial Unwanted/Win.Proxyware.C5943232/C5943233/C5946331 signatures for the resumed campaign.
- ASEC publishes "Larva-25012: A 2026 Proxyware Distribution Campaign," confirming the actor resumed distribution by pivoting to systems already infected with DPLoader rather than opening a new infection vector.
- AhnLab V3 adds Trojan/Win.Loader.C5946067 and C5946330, plus Unwanted/Win.Proxyware.C5946068 and C5946328, covering additional DPLoader/proxyware samples.
- AhnLab V3 adds Downloader/PowerShell.Proxyware.SC316650, covering an updated PowerShell proxyware installer variant.
- AhnLab V3 adds Trojan/Win.Loader.C5948027 and Unwanted/Win.Proxyware.C5948028, the most recent signatures observed for this campaign as of this research.
Sources cited for Larva-25012 Resumes Proxyware Distribution Campaign via
- Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
- Proxyware Disguised as Notepad++ Tool
- Proxyware Malware Being Distributed on YouTube Video Download Site
- DigitalPulse Proxyware Being Distributed Through Ad Pages
- Analysis Report on Larva-24011 Threat Actor's Latest Attack Trend (unrelated cluster, cited for naming-scheme context only)
- 400,000+ Systems Infected: DigitalPulse Proxyware Returns with New Tricks
- Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (mirror)
- Proxyware Malware Disguised as Notepad++ Tool Leverages Windows Explorer Process to Hijack Systems
- Proxyware Malware Masquerades as Notepad++ to Hijack Systems via Windows Explorer
More in malware
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
Detection coverage for TL-2026-2612
As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2612 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.