Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Key Findings
- Sustained delivery. 645+ unique OnionDrop DLL samples between February 28 and May 20, 2026. Delivery remains active at publication.
- Nation-state-grade evasion. Evasion depth rivals purpose-built targeted tooling with no targeting constraints on who it hits.
- Four-stage unpack chain. Custom byte-pair decoding, Xpress Huffman decompression, AES-256-CBC with rotating key context, ending in Donut shellcode.
- DLL sideloading entry point. ZIP archive paired with a legitimate Adobe-signed executable initiates execution through sideloading.
- Anti-analysis by design. Stack-string construction, LdrGetProcedureAddress resolution, API hammering, and display device enumeration defeat static and dynamic review.
- Thread Pool execution. Final shellcode runs through TpPostWork callback abuse, avoiding standard thread-creation telemetry.
- Payload-agnostic loader. Confirmed payloads include LegionLoader (CurlyGate), CGrabber Infostealer, and Vidar Stealer.
- C2 infrastructure. LegionLoader samples communicate with gainmsg[.]com.
- Active family tracking. Third documented component in a campaign, Howler Cell has tracked across CGrabber and Direct-sys Loader.
Overview
OnionDrop is a multi-stage loader built to deliver infostealers at scale. The Howler Cell Threat Research Team has been tracking it across an active campaign spanning multiple payload variants, and the technical depth under the hood warrants attention well beyond the infostealer category it delivers.
Article Link: OnionDrop: Commoditized Loader with Nation-State-Grade Evasion