Sauron Loader is a professionally engineered C++ loader family first documented by DCSO CyTec (published 2026-09-24) after observing it as the final payload in multiple intrusions against German organizations. Victims are reached through deception-based initial access rather than a software vulnerability. DCSO documents two distinct chains: (1) ClickFix-style fake browser "verification" prompts that trick users into pasting and executing attacker-supplied commands, and (2) an email-bombing (mail-flood) precursor followed by a vishing call in which the attacker impersonates IT support and talks the victim into starting a remote-assistance session via Microsoft Quick Assist or AnyDesk, at which point the attacker drives installation directly. DCSO explicitly ties this second pattern to a broader industry trend: eSentire's 2026 threat report documents a 1,450% year-over-year increase in email-bombing-into-IT-impersonation attacks with a 72% observed success rate.

The payload is delivered as an MSI installer that drops three files into a hardcoded directory, C:\ProgramData\keyroll: the legitimate signed binary rnpkeys.exe (associated with the RNP OpenPGP library used by Mozilla Thunderbird), and two malicious libraries, rnp.dll and tdwp.dll. When rnpkeys.exe executes, Windows DLL search-order behavior causes it to load rnp.dll instead of (or in addition to) its legitimate dependency. rnp.dll carries the loader's real functionality in an encrypted form; tdwp.dll decrypts that code directly in memory (no plaintext loader code ever touches disk) and hands off execution, then creates a Windows scheduled task named "keyroll" that relaunches the chain at regular intervals for persistence. Researchers observed a deliberate execution delay during the in-memory decryption step, assessed as a sandbox/analysis-frustration measure, and the loader also fingerprints victim keyboard layout to detect CIS-region systems (the embedded config additionally carries a disable-able CIS-country and government-domain check flag; in the analyzed sample this flag was set to False, consistent with deliberate targeting of German organizations rather than CIS states).

Once running, the loader registers the infected host with its C2 infrastructure (four HTTPS endpoints: api.namsb-show.com, api.quinlantours.com, api.virtual-magic.com, api.lahaina-shores.com), sending hostname, username, and Windows version, with the bot identified by an MD5 hash of computer name, username, and volume serial number. Communication uses a custom binary Type-Length-Value (TLV) protocol over dynamically generated HTTPS paths (pattern /<prefix>/v<1-9>/<action><resource>?<params>, with randomized prefixes, actions, resource names, and 0-3 decoy query parameters to blend into normal API traffic) and browser-spoofing User-Agent strings. Outbound requests are Salsa20-encrypted (16-byte key/8-byte nonce) with an RSA signature (1192-byte private key / 294-byte public key) over the ciphertext plus random padding (1111-9999 bytes); inbound responses use a 32-byte Salsa20 key with RSA signature verification before decryption. Four message types drive the protocol: registration (0x01), task polling with adaptive sleep (160s on failure, 600s after success; 0x02), chunked task-result upload in 0x4000-byte segments (0x03), and payload retrieval (0x04).

Operator tasking supports ten distinct execution handlers: EXE (CreateProcessW), DLL (via rundll32/regsvr32 or a manual PE loader), Driver (.sys installed as a Windows service), Shellcode (executed in-memory or injected into attrib.exe), MSI (MsiInstallProductW), ZIP (extracted to %TEMP%\<random 6-16 chars>.<ext> and executed), plus CMD, PowerShell (with ExecutionPolicy Bypass), VBScript, and JavaScript command execution. Discovery telemetry beyond the registration fields includes domain-membership, privilege level, installed security-product enumeration, and network configuration. The loader also supports PNG screenshot capture (primary monitor or full virtual desktop), chunked and exfiltrated over the same encrypted C2 channel with bot ID, task ID, and chunk metadata attached to each transmission.

DCSO CyTec found Sauron Loader advertised under the alias "S4ur0n" on Russian-speaking underground forums as a malware-as-a-service offering, with the seller claiming restrictions against targeting CIS countries and public-sector organizations — a claim that does not itself establish attacker nationality or affiliation, and multiple observed C2 infrastructure variants (differing domains, shared core behavior) suggest resale or use by more than one operator/affiliate, and are deliberately diversified to prevent single-point network blocking. No CVE or software vulnerability is involved; this is a social-engineering-driven malware deployment. DCSO published a MISP event and a Python 3 configuration-extraction utility (get_config.py) alongside the analysis, which parses the embedded encrypted config to recover the magic value, flag bits (including the CIS/government-domain check), RSA key material and its SHA-256 fingerprints, group/build identifiers, and the C2 URL array. Defensive guidance from the source focuses on detecting unexpected installer/msiexec activity, anomalous DLL loads by signed binaries, unexpected new scheduled tasks or services, unexplained encrypted egress with dynamically-shaped API-like paths, unauthorized AnyDesk/Quick Assist sessions, and verifying any unsolicited IT-support contact through established internal channels before following remote-access instructions.