# Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems

> AhnLab ASEC confirmed on 2026-09-17 that the tracked threat cluster Larva-25012 resumed active proxyware distribution in H2 2026 by pivoting to systems already infected with the DPLoader downloader rather than opening new infection vectors. DPLoader (JavaScript and Python variants) beacons to cloud-hosted C2 infrastructure and pulls PowerShell scripts that silently register DigitalPulse, SOAX, Appsalt, and IPRoyal proxyware via Task Scheduler for bandwidth-hijacking (proxyjacking) monetization.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2612
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-larva-25012-proxyware-campaign-tl-2026-2612.webp?v=1c769b0c (Threadlinqs threat intel: Larva-25012 Proxyware Monetization: Detection & IOCs (TL-2026-2612) — Medium severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-2612
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Larva‑25012
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

Larva-25012 is AhnLab ASEC's tracking designation for a financially motivated threat cluster that has distributed unwanted proxyware/bandwidth-sharing SDKs (DigitalPulse, Honeygain, Infatica, SOAX, Appsalt, IPRoyal) since at least 2024, primarily via pop-up ads on free YouTube-video-download sites, GitHub repositories disguised as a Steam cleanup tool, cracked-software portals, and (in a January 2026 wave) a fake Notepad++ installer. In its September 2026 report, ASEC documented that the actor did not need a new delivery vector for its latest wave: it simply leveraged the large existing population of Windows hosts already carrying DPLoader, a lightweight JavaScript/Python downloader that collects basic host information, periodically beacons it to command-and-control infrastructure, and executes PowerShell commands returned by the C2 server.

In the observed 2026-09 activity, DPLoader's C2/download infrastructure is hosted on abused cloud web services rather than dedicated attacker-owned servers: an AWS Lambda Function URL (7jb7qi6vnr5pa22a4br4irz3tu0yqzbd.lambda-url.us-east-1.on.aws) and multiple Amazon CloudFront distributions serve PowerShell downloader scripts, proxyware executables, and SDK DLLs. The downloaded PowerShell installs one or more proxyware packages, each wired into Windows Task Scheduler under a name designed to blend in with legitimate system/security tooling: DigitalPulse as "PlutonAgentScheduler" (dropping plutonagent.exe under %SystemRoot%\pluton\<random>\ and disabling Microsoft Defender), SOAX as "EnterpriseMgmtServicesScheduler" (an SDK DLL loader masquerading as deephour.exe or a fake copilotservice.exe under a spoofed Microsoft Copilot services path), Appsalt as "SecurityHealthServiceSyncUpdate" (an SDK DLL loader calling the exported appsalt_init() function from appsalt.dll, disguised as a Windows servicing binary), and IPRoyal as "BackgroundTaskRegistrationMaintenanceTaskScheduler" (loading the IPRoyal Pawns SDK via pawns-sdk.dll). Each proxyware package resells the infected host's internet bandwidth to the vendor's residential-proxy network, generating referral/usage revenue for the threat actor while the victim is unaware their connection is being resold.

This is a repeat pattern for the cluster: a 2023 LevelBlue report already tied an earlier DigitalPulse proxyjacking wave to over 400,000 infected Windows systems, and ASEC's own 2025-2026 reporting traces a consistent evolution of the same playbook — CloudFront-hosted JavaScript/PowerShell downloaders, Task Scheduler persistence under innocuous-sounding names ("DefragDiskCleanup", "FastDiskCleanup", "FastCleanPlus.exe", "Network Performance"), anti-VM/sandbox checks, abuse of code-signing certificates, and (in the January 2026 wave) direct DLL injection of a Go-based DigitalPulse payload into explorer.exe via a rundll32-loaded "syncupdates.dll" injector. AhnLab's "Larva-24011" designation is an unrelated cluster (MS-SQL/IIS server compromise, web shells, Gh0st RAT/AnyDesk, XMRig) that happens to share the sequential Larva-NNNNN naming scheme with no other overlap; it is noted here only to avoid conflating the two. There is no CVE or software vulnerability involved — the vector is unauthorized/unwanted-program installation via an existing malware foothold, not exploitation.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1059.006 Python
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1055.001 Dynamic-link Library Injection
- T1218.011 Rundll32
- T1497.001 System Checks
- T1553.002 Code Signing
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1583.006 Web Services
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Scheduled Task Creation Matching Larva-25012 Proxyware Persistence Names** (`TL-2026-2612-SPL-002`)

Detects Task Scheduler operational-log task registration events whose TaskName exactly matches one of the four persistence mechanisms Larva-25012 registers to relaunch DigitalPulse, SOAX, Appsalt, or IPRoyal proxyware after reboot.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1036.005
- **Data sources:** windows_task_scheduler_operational_log
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" EventCode=106
| eval known_task=if(match(lower(TaskName), "plutonagentscheduler") OR match(lower(TaskName), "enterprisemgmtservicesscheduler") OR match(lower(TaskName), "securityhealthservicesyncupdate") OR match(lower(TaskName), "backgroundtaskregistrationmaintenancetaskscheduler"), 1, 0)
| where known_task=1
| table _time, ComputerName, UserContext, TaskName, EventCode
| sort - _time
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ScheduledTaskCreated"
| extend TaskName = tostring(parse_json(AdditionalFields).TaskName)
| where TaskName has_any ("PlutonAgentScheduler","EnterpriseMgmtServicesScheduler","SecurityHealthServiceSyncUpdate","BackgroundTaskRegistrationMaintenanceTaskScheduler")
| project Timestamp, DeviceName, InitiatingProcessAccountName, TaskName, ActionType
```

### Sigma

```yaml
title: Scheduled Task Created Matching Larva-25012 Proxyware Persistence Names
id: 1e2d3c4b-5a69-4f78-9012-abcdef012345
status: experimental
description: Detects creation of a Windows Scheduled Task whose name matches one of the four persistence mechanisms Larva-25012 uses to relaunch DigitalPulse, SOAX, Appsalt, or IPRoyal proxyware.
references:
    - https://asec.ahnlab.com/en/95516/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-22
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: windows
    service: taskscheduler
detection:
    selection:
        EventID: 106
        TaskName|contains:
            - 'PlutonAgentScheduler'
            - 'EnterpriseMgmtServicesScheduler'
            - 'SecurityHealthServiceSyncUpdate'
            - 'BackgroundTaskRegistrationMaintenanceTaskScheduler'
    condition: selection
falsepositives:
    - None expected; these task names are attacker-chosen and not used by legitimate Microsoft or third-party software
level: high
```

**Known false positives:**

- None expected; these task names are attacker-chosen and not used by legitimate Microsoft or third-party software

**Tuning notes:** Extend TaskName matching if the actor rotates naming conventions in future waves — prior campaigns used FastDiskCleanup, DefragDiskCleanup, and Network Performance; alert on TaskContentNew referencing the known install paths (plutonagent.exe, deephour.exe, copilotservice.exe, securityhealthservicesyncupdate.exe, TaskRegistrationMaintenance.exe) even if the TaskName itself changes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Correlated PowerShell + Network Connection to Confirmed Larva-25012 Delivery Domains (locked: unlock with TL Creds)
- Defender Real-Time Protection Tampering Co-occurring with Proxyware Install-Path Activity (locked: unlock with TL Creds)
- High-Volume Outbound Connections from Larva-25012 Proxyware Binaries (Resource Hijacking) (locked: unlock with TL Creds)
- DPLoader-Style PowerShell Downloader Retrieving Proxyware Installer Script (locked: unlock with TL Creds)
- Process Execution from Larva-25012 Proxyware Masqueraded Install Paths (locked: unlock with TL Creds)
- Rundll32-Loaded syncupdates.dll Preceding Explorer.exe Process Injection (DigitalPulse) (locked: unlock with TL Creds)
- DPLoader-Stage PowerShell Beaconing to Abused AWS Lambda / CloudFront C2 (locked: unlock with TL Creds)
- Rundll32 or Explorer Loading Larva-25012 Proxyware SDK DLLs (Process Injection / LOLBin Abuse) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- URL: `hxxps://7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e`
- File hash: `0066422310c880d5e722ba59ad315df1`
- URL: `hxxps://d36rb13t9es4g1[.]cloudfront[.]net/192837455732.ps1`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)](https://asec.ahnlab.com/en/95516/)
- [Proxyware Disguised as Notepad++ Tool](https://asec.ahnlab.com/en/92183/)
- [Proxyware Malware Being Distributed on YouTube Video Download Site](https://asec.ahnlab.com/en/89574/)
- [DigitalPulse Proxyware Being Distributed Through Ad Pages](https://asec.ahnlab.com/en/85798/)
- [Analysis Report on Larva-24011 Threat Actor's Latest Attack Trend (unrelated cluster, cited for naming-scheme context only)](https://asec.ahnlab.com/en/85213/)
- [400,000+ Systems Infected: DigitalPulse Proxyware Returns with New Tricks](https://securityonline.info/400000-systems-infected-digitalpulse-proxyware-returns-with-new-tricks/)
- [Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (mirror)](https://www.hendryadrian.com/larva-25012-a-2026-proxyware-distribution-campaign-by-the-threat-actor-digitalpulse-soax-appsalt-iproyal/)
- [Proxyware Malware Disguised as Notepad++ Tool Leverages Windows Explorer Process to Hijack Systems](https://cybersecuritynews.com/proxyware-malware-disguised-as-notepad-tool/)
- [Proxyware Malware Masquerades as Notepad++ to Hijack Systems via Windows Explorer](https://gbhackers.com/proxyware-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2612