⚠️ Overview

Loup is a backdoor trojan first documented in July 2025 by cybersecurity vendor Cyble, attributed to a Chinese-speaking threat actor tracked as TA558. It is classified as a Remote Access Trojan (RAT) designed for espionage and data exfiltration, primarily targeting organizations in Latin America and Southeast Asia.

🔧 Technical Capabilities

Loup achieves initial infection via spear-phishing emails containing malicious Microsoft Office documents that exploit the CVE-2017-11882 Equation Editor vulnerability to download and execute the payload. The malware establishes persistence by creating a scheduled task named "SystemUpdateService" and modifying the Windows Registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Loup uses a domain-generation algorithm (DGA) for command-and-control communication, contacting hardcoded CC servers over HTTP/HTTPS and implementing a custom XOR-based encryption layer to obfuscate traffic. It performs keylogging, captures clipboard data, and enumerates victim machine information including system specs, installed software, and running processes. Evasion techniques include anti-debugging checks via IsDebuggerPresent and NtQueryInformationProcess, as well as executable packing with UPX to hinder static analysis.

📜 History & Notable Incidents

Loup was first observed in active campaigns during April 2025, with a notable wave detected in July 2025 targeting agricultural and manufacturing sectors in Mexico and the Philippines. The malware has been linked to the APT group TA558 by Cyble’s research team, based on infrastructure overlaps and TTPs previously attributed to that group. No law enforcement actions or arrests have been publicly reported as of August 2025.

🔍 Detection Indicators

Known file hashes include SHA256 7c8a3b1f9e2d4c5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f (associated with a July 2025 Loup sample). Network indicators include CC domains such as "lovely-update[.]top" and "system-check[.]pro", and User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36". Behavioral signatures include creation of the scheduled task "SystemUpdateService" and file writes to %AppData%MicrosoftSystemHelper.exe.

☠️ Risk & Impact

Loup exfiltrates sensitive information including login credentials, financial documents, and proprietary industrial data, leading to potential intellectual property theft and supply chain compromise. The primary affected industries are agriculture, manufacturing, and logistics in Latin America, with Cyble reporting that over 200 organizations were impacted in the July 2025 campaign. Financial losses are difficult to quantify but the data theft could enable secondary ransomware intrusions or business email compromise.

🛡️ Mitigation

Mitigation includes applying Microsoft security patch for CVE-2017-11882, enabling macro blocking in Office, and configuring EDR tools to detect the scheduled task name and UDP traffic to suspicious high-numbered ports. Cyble recommends network-level blocking of the known CC domains and implementing YARA rules using the DGA patterns.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.