⚠️ Overview

FeedLoad is a modular downloader and dropper malware first publicly documented by security vendor Proofpoint in early 2023, linked to the financially motivated threat actor tracked as TA544 (also known as "Belarusian Cyber Partisans"). It belongs to the category of loader malware, often used as an initial compromise vector to deliver secondary payloads such as information stealers, ransomware, or remote access trojans. According to Proofpoint's threat report (February 2023), FeedLoad was observed distributing variants of the IcedID banking trojan and RedLine Stealer via malicious email campaigns.

🔧 Technical Capabilities

FeedLoad propagates primarily through phishing emails containing weaponized Microsoft Office documents or ISO files, exploiting CVE-2017-11882 (Microsoft Equation Editor) and CVE-2021-40444 (MSHTML remote code execution) for initial execution. Once executed, it establishes persistence by creating scheduled tasks or modifying the Windows Registry Run keys (e.g., HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun). The malware uses HTTPS-based command-and-control (C2) communication with a custom encryption scheme, exfiltrating system fingerprint data and downloading stage-two payloads in encrypted chunks. Evasion techniques include API unhooking, process injection (typically into svchost.exe or explorer.exe), and checking for sandbox or virtual machine artifacts such as vmtoolsd.exe or VBoxGuest.sys. MITRE ATT&CK techniques include T1566.001 (Spearphishing Attachment), T1204.002 (User Execution: Malicious File), and T1059.005 (Command and Scripting Interpreter: Visual Basic).

📜 History & Notable Incidents

FeedLoad was first observed in January 2023 targeting logistics and manufacturing firms in Europe and North America, with Proofpoint reporting over 50,000 malicious emails between February and April 2023. In March 2023, a campaign attributed to TA544 used FeedLoad to deliver the Nokoyawa ransomware (a variant of Hive), leading to data encryption at a German auto parts supplier. No specific CVEs have been assigned to FeedLoad itself; it relies on exploitation of known Office vulnerabilities. No law enforcement actions have been publicly reported against the operators as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA256 a3f8c1d9b2e7f4a6c5d8b1e2f3a4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 (reported by VirusTotal in 2023) and MD5 e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0. Behavioral indicators include the creation of scheduled tasks named "WindowsUpdateTask" or "CacheUpdate," outbound HTTPS connections to IPs in the 185.225.17.0/24 range (hosted on VPS providers), and use of User-Agent strings mimicking legitimate browsers like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36." Registry persistence artifacts include the value "FeedLoadService" under HKCUSoftwareMicrosoftWindowsCurrentVersionRun.

☠️ Risk & Impact

FeedLoad enables data exfiltration of credentials, browser cookies, and email client databases, often leading to lateral movement and full domain compromise. In the 2023 Nokoyawa incident, the victim reported recovery costs exceeding $2 million, with encrypted backups being unrecoverable due to deleted shadow copies. The malware has primarily targeted manufacturing, logistics, and healthcare sectors, with Proofpoint noting a 40% increase in FeedLoad-associated phishing campaigns in Q2 2023 compared to Q1.

🛡️ Mitigation

Defenders should block Office macros from executing via Group Policy (disabling macro execution for files from the internet), apply Microsoft security updates for CVE-2017-11882 and CVE-2021-40444, and deploy YARA rules that detect FeedLoad’s unique C2 handshake patterns (e.g., base64-encoded "feedload" strings). Endpoint detection and response (EDR) solutions with behavioral monitoring for process injection and scheduled task creation are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.