⚠️ Overview

CustomerLoader is a downloader malware first documented by cybersecurity firm Proofpoint in January 2022, attributed to the threat actor cluster TA544 (also known as Cobalt Group or UNC532). It belongs to the loader category, designed to deliver secondary payloads such as IcedID, Formbook, and Agent Tesla via malvertising and phishing campaigns.

🔧 Technical Capabilities

CustomerLoader primarily propagates through malvertising, specifically fake software download pages (e.g., for TeamViewer, Discord, or Microsoft Teams) that redirect users to a compressed executable. It uses a multi-stage delivery chain: an initial .MSI installer or ZIP archive drops a loader DLL that employs process hollowing or DLL sideloading to execute shellcode. The malware maintains persistence by creating scheduled tasks or modifying registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun). For C2 communication, it relies on HTTP/HTTPS with encrypted payloads using AES-256 and RC4; some variants use dead-drop resolvers on legitimate services like Discord CDN or Bitbucket to fetch C2 URLs. Evasion techniques include anti-debugging checks (IsDebuggerPresent, NtQueryInformationProcess), sandbox detection via CPU core count and disk size, and obfuscation using custom packers (e.g., VMProtect, ConfuserEx). MITRE ATT&CK techniques observed include T1204.002 (User Execution: Malicious File), T1055.001 (Process Injection: DLL Injection), and T1071.001 (Application Layer Protocol: Web Protocols).

📜 History & Notable Incidents

First spotted in late 2021, CustomerLoader gained prominence in early 2022 during a malvertising campaign that infected over 100,000 users by posing as software updates. In July 2022, researchers at Cyble reported a campaign distributing Bumblebee loader via CustomerLoader droppers. No CVEs are directly associated with CustomerLoader itself, but it has been used in supply-chain style attacks against the logistics sector. As of 2023, the operator infrastructure shifted to using Freenom domains and Cloudflare CDN for resilience.

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (a dropper sample, per Proofpoint). Behavioral IOCs include creation of temporary files in %TEMP% with random .dll or .tmp extensions, outbound HTTPS traffic to domains like cdn.discordapp.com or api.telegram.org used as fallback C2, and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with keys named "WindowsUpdate" or "OneDriveUpdate". Network indicators include User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 with minor variations.

☠️ Risk & Impact

The primary risk is the delivery of information stealers and banking trojans, leading to credential theft, financial fraud, and data exfiltration. Affected sectors include finance, healthcare, and retail, with individual users also targeted via fake software downloads. A 2022 campaign attributed to TA544 caused estimated losses exceeding $2 million through IcedID-enabled ransomware deployments.

🛡️ Mitigation

Defenders should block known malvertising domains via DNS filtering, enable Microsoft Defender for Endpoint with ASR rules (e.g., block Office applications from creating child processes), and deploy YARA rules targeting CustomerLoader's custom packers. Regular user awareness training about fake download pages is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.