Loader.

A loader is a specialized first-stage component whose primary job is to fetch, decode, and execute additional malware in memory, typically through reflective DLL injection, process hollowing, or shellcode. It often profiles the host, disables defences, and establishes persistence before passing control to the next stage. Loaders are central to the modern malware-as-a-service economy, where access brokers sell installs to ransomware affiliates and info-stealer operators — the loader is the toll booth between initial access and monetization.

Real loaders and their takedowns

QakBot (Qbot) was the archetype: a banking-trojan-turned-loader that seeded ransomware for Conti, REvil, ProLock, Egregor, and Black Basta. In August 2023 the FBI-led Operation Duck Hunt seized 52 servers, redirected the botnet through Bureau-controlled infrastructure, pushed an uninstaller to over 700,000 infected hosts, and tied the operation to roughly $58M in ransom fees. Europol's Operation Endgame (May 2024) then dismantled a wave of successor loaders — IcedID, SmokeLoader, Pikabot, SystemBC, and Bumblebee — the largest-ever action against the loader ecosystem. These campaigns confirm the pattern: disrupt the loader layer and you starve downstream ransomware.

Because loaders increasingly run fileless — decrypting payloads only in memory and abusing signed LOLBins (rundll32, regsvr32, mshta) — signature scanning alone misses them. Effective defences layer EDR/XDR with behavioural detection of injection (CreateRemoteThread, hollowed processes), AMSI-instrumented script inspection, PowerShell Constrained Language Mode, application allow-listing, macro and LNK/ISO delivery controls, and threat intelligence on active loader families.

flowchart LR
  A[Initial access: phishing LNK / ISO / macro] --> B[Loader executes]
  B --> C[Profile host and disable defences]
  C --> D[Establish persistence]
  D --> E[Fetch encrypted payload from C2]
  E --> F[Decrypt and inject in memory]
  F --> G{Next stage}
  G --> H[Ransomware]
  G --> I[Info-stealer]
  G --> J[Cobalt Strike beacon]