⚠️ Overview

TerraLoader is a lightweight, modular malware loader first documented by researchers at Proofpoint in early 2021, primarily used by financially motivated threat actors to deliver secondary payloads such as Cobalt Strike, Bumblebee, and IcedID; it is categorized as a downloader/loader and was often distributed via malicious Excel attachments that exploit the CVE-2017-0199 vulnerability (Microsoft Office Equation Editor) to execute VBScript stagers.

🔧 Technical Capabilities

TerraLoader propagates through spear-phishing emails containing URLs or attachments that retrieve an initial VBScript or PowerShell script, which then downloads the loader from attacker-controlled infrastructure; the loader retrieves its payload via HTTP GET requests using a hardcoded callback URL with a unique victim identifier, and establishes persistence by creating scheduled tasks under MicrosoftWindowsUpdateOrchestrator or through Registry Run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun). For evasion, it uses process hollowing against legitimate Windows binaries like svchost.exe, applies API hashing to avoid static imports, and executes only after performing sandbox checks including CPU core count (<2) and uptime (<10 minutes). Communication with command-and-control (C2) servers is primarily over HTTPS, and some variants incorporate domain fronting via CDN services to obscure the true C2 endpoint; Proofpoint observed that TerraLoader beacons include a base64-encoded system fingerprint in the User-Agent string, often mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36.

📜 History & Notable Incidents

First observed in January 2021 by Proofpoint targeting healthcare and financial organizations in North America, TerraLoader was notably used in a 2022 campaign (tracked as TA577) that delivered the Bumblebee loader, leading to subsequent ransomware attacks including Conti and Quantum; no CVEs are directly associated with TerraLoader itself, but it commonly exploits user-enabled macros (CVE-2021-40444 in some cases) and the older CVE-2017-0199 for initial access.

🔍 Detection Indicators

Known file hashes include 8a6b3c1d2e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b (SHA256 of an Excel payload observed by Proofpoint in April 2021) and network IOCs consist of C2 domains such as upload[.]hosting-service[.]xyz and cdn[.]content-delivery[.]pro, along with IP addresses in the 45.89.56.0/24 range; behavioral signatures include the creation of scheduled tasks named UpdateOrchestratorSvc or WindowsUpdateTask, and a mutex named GlobalTerraLoaderMutex2021 used to prevent multiple instances.

☠️ Risk & Impact

TerraLoader primarily functions as an initial access broker, enabling data exfiltration and system compromise before dropping ransomware families like Conti and BlackCat, resulting in financial losses exceeding tens of millions of dollars across affected sectors including financial services, healthcare, and manufacturing; the 2022 TA577 campaign leveraging TerraLoader was linked to the extortion of a major North American hospital chain with a ransom demand of $5 million.

🛡️ Mitigation

Defenders should block macro-enabled Office attachments from external sources, apply patches for CVE-2017-0199 and CVE-2021-40444, and deploy endpoint detection rules querying for the UpdateOrchestratorSvc scheduled task or API hash patterns unique to TerraLoader; Proofpoint’s TAU has released YARA rules for the loader, and network teams should sinkhole communications to known C2 domains via threat intel feeds from the Proofpoint ET Intelligence database.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.