# Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix, Email Bombing, and Remote-Access-Tool Vishing

> DCSO CyTec identified "Sauron Loader," a previously undocumented C++ loader sold as malware-as-a-service in Russian-speaking underground forums, deployed as the final stage in intrusions against German organizations. It abuses DLL side-loading via the legitimate rnpkeys.exe (part of Mozilla's RNP/OpenPGP tooling) to load rnp.dll and tdwp.dll, establishes persistence via a scheduled task named "keyroll," and communicates with C2 over HTTPS using a custom TLV protocol with Salsa20 encryption and RSA-signed messages.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2685
- **ID:** TL-2026-2685
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** S4ur0n
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Sauron Loader is a professionally engineered C++ loader family first documented by DCSO CyTec (published 2026-09-24) after observing it as the final payload in multiple intrusions against German organizations. Victims are reached through deception-based initial access rather than a software vulnerability. DCSO documents two distinct chains: (1) ClickFix-style fake browser "verification" prompts that trick users into pasting and executing attacker-supplied commands, and (2) an email-bombing (mail-flood) precursor followed by a vishing call in which the attacker impersonates IT support and talks the victim into starting a remote-assistance session via Microsoft Quick Assist or AnyDesk, at which point the attacker drives installation directly. DCSO explicitly ties this second pattern to a broader industry trend: eSentire's 2026 threat report documents a 1,450% year-over-year increase in email-bombing-into-IT-impersonation attacks with a 72% observed success rate.

The payload is delivered as an MSI installer that drops three files into a hardcoded directory, C:\ProgramData\keyroll: the legitimate signed binary rnpkeys.exe (associated with the RNP OpenPGP library used by Mozilla Thunderbird), and two malicious libraries, rnp.dll and tdwp.dll. When rnpkeys.exe executes, Windows DLL search-order behavior causes it to load rnp.dll instead of (or in addition to) its legitimate dependency. rnp.dll carries the loader's real functionality in an encrypted form; tdwp.dll decrypts that code directly in memory (no plaintext loader code ever touches disk) and hands off execution, then creates a Windows scheduled task named "keyroll" that relaunches the chain at regular intervals for persistence. Researchers observed a deliberate execution delay during the in-memory decryption step, assessed as a sandbox/analysis-frustration measure, and the loader also fingerprints victim keyboard layout to detect CIS-region systems (the embedded config additionally carries a disable-able CIS-country and government-domain check flag; in the analyzed sample this flag was set to False, consistent with deliberate targeting of German organizations rather than CIS states).

Once running, the loader registers the infected host with its C2 infrastructure (four HTTPS endpoints: api.namsb-show.com, api.quinlantours.com, api.virtual-magic.com, api.lahaina-shores.com), sending hostname, username, and Windows version, with the bot identified by an MD5 hash of computer name, username, and volume serial number. Communication uses a custom binary Type-Length-Value (TLV) protocol over dynamically generated HTTPS paths (pattern /<prefix>/v<1-9>/<action><resource>?<params>, with randomized prefixes, actions, resource names, and 0-3 decoy query parameters to blend into normal API traffic) and browser-spoofing User-Agent strings. Outbound requests are Salsa20-encrypted (16-byte key/8-byte nonce) with an RSA signature (1192-byte private key / 294-byte public key) over the ciphertext plus random padding (1111-9999 bytes); inbound responses use a 32-byte Salsa20 key with RSA signature verification before decryption. Four message types drive the protocol: registration (0x01), task polling with adaptive sleep (160s on failure, 600s after success; 0x02), chunked task-result upload in 0x4000-byte segments (0x03), and payload retrieval (0x04).

Operator tasking supports ten distinct execution handlers: EXE (CreateProcessW), DLL (via rundll32/regsvr32 or a manual PE loader), Driver (.sys installed as a Windows service), Shellcode (executed in-memory or injected into attrib.exe), MSI (MsiInstallProductW), ZIP (extracted to %TEMP%\<random 6-16 chars>.<ext> and executed), plus CMD, PowerShell (with ExecutionPolicy Bypass), VBScript, and JavaScript command execution. Discovery telemetry beyond the registration fields includes domain-membership, privilege level, installed security-product enumeration, and network configuration. The loader also supports PNG screenshot capture (primary monitor or full virtual desktop), chunked and exfiltrated over the same encrypted C2 channel with bot ID, task ID, and chunk metadata attached to each transmission.

DCSO CyTec found Sauron Loader advertised under the alias "S4ur0n" on Russian-speaking underground forums as a malware-as-a-service offering, with the seller claiming restrictions against targeting CIS countries and public-sector organizations — a claim that does not itself establish attacker nationality or affiliation, and multiple observed C2 infrastructure variants (differing domains, shared core behavior) suggest resale or use by more than one operator/affiliate, and are deliberately diversified to prevent single-point network blocking. No CVE or software vulnerability is involved; this is a social-engineering-driven malware deployment. DCSO published a MISP event and a Python 3 configuration-extraction utility (get_config.py) alongside the analysis, which parses the embedded encrypted config to recover the magic value, flag bits (including the CIS/government-domain check), RSA key material and its SHA-256 fingerprints, group/build identifiers, and the C2 URL array. Defensive guidance from the source focuses on detecting unexpected installer/msiexec activity, anomalous DLL loads by signed binaries, unexpected new scheduled tasks or services, unexplained encrypted egress with dynamically-shaped API-like paths, unauthorized AnyDesk/Quick Assist sessions, and verifying any unsolicited IT-support contact through established internal channels before following remote-access instructions.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1667 Email Bombing
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1574.001 DLL
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1497.003 Time Based Checks
- T1218.007 Msiexec
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1614.001 System Language Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1219 Remote Access Tools
- T1588.001 Malware

## Sources

- [Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection](https://cybersecuritynews.com/sauron-loader-malware/)
- [Sauron Loader: A New Loader Lurking in Underground Forums](https://medium.com/@DCSO_CyTec/sauron-loader-a-new-loader-lurking-in-underground-forums-e91fa70db537)
- [Sauron Loader: A New Loader Lurking in Underground Forums (mirror)](https://malware.news/t/sauron-loader-a-new-loader-lurking-in-underground-forums/125861)
- [Sauron Loader Malware Uses DLL Side-Loading and In-Memory Decryption to Evade Detection](https://www.cryptika.com/sauron-loader-malware-uses-dll-side-loading-and-in-memory-decryption-to-evade-detection/)
- [Sauron Loader Sold to Russian-Speaking Criminals Targets German Organizations](https://mallory.ai/stories/01a0d394-7e3b-7cab-81d6-75ed9b72f45c)
- [DCSO Blog_CyTec: 2026_09__sauron_loader (IOCs, MISP event, config-extraction tool)](https://github.com/DCSO/Blog_CyTec/tree/main/2026_09__sauron_loader)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2685