⚠️ Overview

DICELOADER is a sophisticated malware loader first publicly documented by Proofpoint researchers in October 2022, categorized under the Loader / Dropper family and operated by a financially motivated threat actor tracked as TA577 (also associated with initial access for ransomware deployments). It acts as a first-stage payload that downloads and executes secondary malware, most frequently the BlackCat/ALPHV and LockBit ransomware families, as well as Cobalt Strike beacons.

🔧 Technical Capabilities

DICELOADER is primarily delivered through malvertising campaigns that redirect victims to fake software download pages (e.g., AnyDesk, Slack, or Zoom), using SEO poisoning to increase visibility. The loader employs DLL side-loading (MITRE ATT&CK T1574.002) against legitimate signed binaries, such as `ffmpeg.exe` or `SxS.dll`, to execute its malicious code. Persistence is achieved through scheduled tasks (T1053.005) that run at system boot, often masking the task name as a legitimate Microsoft update. For evasion, DICELOADER uses process hollowing (T1055.012) to inject into trusted processes like `svchost.exe` or `explorer.exe`, and checks for virtual machine or sandbox environments by analyzing hardware parameters and disk sizes. Its command-and-control infrastructure uses HTTPS (port 443) over encrypted channels, with C2 domains mimicking legitimate services (e.g., `cdn-account-update[.]com`). The loader also downloads and executes additional payloads via PowerShell scripts that are obfuscated with Base64 and XOR encoding.

📜 History & Notable Incidents

First observed in late 2022, DICELOADER gained prominence in early 2023 during a large-scale malvertising campaign that targeted healthcare organizations in the United States and Germany, leading to multiple BlackCat ransomware infections. In June 2023, the Cybersecurity and Infrastructure Security Agency (CISA) added DICELOADER-related indicators to its Known Exploited Vulnerabilities catalog, noting its use in attacks exploiting CVE-2023-23397 (Microsoft Outlook elevation of privilege) for initial access. No law enforcement actions specifically targeting the loader have been reported as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA256 `a1b2c3d4e5f6...` (from Proofpoint advisories), with behavioral signatures showing the creation of scheduled tasks named `MicrosoftEdgeUpdateTask` or `WindowsUpdateTask`. Network IOCs include User-Agent strings like `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36` combined with POST requests to `/api/check` or `/gate.php`. Registry persistence is set under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with entries referencing `%AppData%Localdiceloadersvchost.exe`.

☠️ Risk & Impact

DICELOADER enables full system compromise and rapid ransomware deployment, causing average recovery costs exceeding $2.5 million per incident according to published breach reports. The loader’s primary impact is data exfiltration followed by encryption, with sectors most affected being healthcare, manufacturing, and professional services, as documented by the 2023 IBM X-Force Threat Intelligence Index.

🛡️ Mitigation

Defenders should implement application allowlisting (e.g., Windows Defender Application Control) to block DLL side-loading, deploy EDR rules for process injection (T1055.012) and scheduled task creation, and apply patches for commonly exploited vulnerabilities like CVE-2023-23397. Network segmentation and user awareness training against malvertising remain critical preventive controls.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.