PavinLoader Ransomware: Multi-Stage Loader Facilitates Global Malware Campaigns (June 2026)

PavinLoader: What Happened

PavinLoader, a sophisticated multi-stage malware loader, has been observed in multiple ransomware campaigns with a global reach. The loader was deployed in attack chains including ClickFix and fake software download campaigns, targeting unknown organizations. Attackers utilized advanced obfuscation techniques in .NET DLLs and leveraged EtherHiding to evade analysis and detection. The confirmed impact includes the deployment of information-stealing malware such as Amatera Stealer, enabling further compromise of victim systems and exfiltration of sensitive data.

Attack Vector & Technical Detail

The infection chain begins with the delivery of obfuscated .NET DLLs, often disguised as legitimate installers or software updates. PavinLoader leverages legitimate Windows tools to execute its payloads, making detection challenging. Key indicators of compromise (IOCs) identified in these campaigns include files such as prefetch_9a59.cmd, telemetry_55db.cmd, bootstrap_64be.cmd, aegZpQ4C7.bat, Small.msi, small.bat, small.cmd, Installer_57be78.msi, DotNetZip.dll, Nancy.dll, Renci.SshNet.dll, and OpenXML.dll. The loader employs MITRE ATT&CK tactics TA0001 (Initial Access), TA0005 (Defense Evasion), TA0007 (Discovery), TA0011 (Command and Control), and TA0040 (Impact), reflecting a comprehensive approach to intrusion and persistence. No CVEs have been directly associated with these campaigns to date.

Confirmed Impact

The deployment of PavinLoader has resulted in the installation of Amatera Stealer and potentially other malicious payloads, leading to the theft of sensitive information and the risk of additional malware delivery. The campaigns have been observed globally, with no specific organizations named as victims. The use of advanced anti-analysis and obfuscation techniques increases the risk of undetected compromise, raising concerns for organizations subject to data protection regulations and incident reporting requirements.

What This Means for Your Organization

Organizations should be alert to the use of legitimate Windows tools in malware delivery, as demonstrated by PavinLoader’s tactics. Security teams must monitor for suspicious installer activity and the presence of known IOCs, such as unusual .cmd, .bat, and .msi files. Enhanced behavioral analytics and endpoint detection can help identify and block multi-stage loaders before they facilitate further compromise. Regular user education on the risks of downloading software from untrusted sources remains critical.

Detection & Response

• Immediate: Block and quarantine files matching known IOCs, including prefetch_9a59.cmd, Small.msi, and DotNetZip.dll.
• Hunt: Search for execution of obfuscated .NET DLLs and monitor for the presence of files such as telemetry_55db.cmd and aegZpQ4C7.bat across endpoints.
• Patch: N/A (no CVEs directly involved in this campaign).

Source: https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns