Threat researchers have uncovered a sophisticated malware distribution campaign that leverages websites offering pirated software to disseminate an updated variant of CountLoader, a modular and evasive malware loader engineered to bypass endpoint defenses and facilitate follow-on compromise.

According to analysts from the Cyderes Howler Cell Threat Intelligence team, CountLoader functions as the initial access component within a multi-stage intrusion framework. Its role is to establish foothold access, evade security controls, and enable the deployment of additional malicious payloads across infected hosts.

Overview of CountLoader

Previously analyzed by security vendors including Fortinet and Silent Push, CountLoader has a documented history of delivering secondary payloads such as Cobalt Strike, AdaptixC2, PureHVNC RAT, Amatera Stealer, and PureMiner. Telemetry indicates that the malware has been active in the wild since at least June 2025.

Infection Workflow

The infection chain is initiated when users search online for cracked versions of popular software (for example, Microsoft Word). Victims are redirected to a MediaFire download hosting a malicious ZIP archive. The archive contains two files: a password-protected ZIP file and a decoy Microsoft Word document that provides the password required to extract the encrypted archive.

Once unpacked, the encrypted ZIP reveals a renamed Python interpreter masquerading as Setup.exe. This executable is weaponized to launch a malicious command that abuses mshta.exe to retrieve CountLoader v3.2 from a remote infrastructure endpoint.

Persistence and Defense Evasion

To achieve long-term persistence, CountLoader creates a scheduled task labeled “GoogleTaskSystem136.0.7023.12”, intentionally designed to resemble a legitimate Google component. The task is configured to execute every 30 minutes for a duration of up to ten years and invokes mshta.exe to contact a fallback command-and-control (C2) domain.

The malware further incorporates endpoint detection awareness by querying Windows Management Instrumentation (WMI) to determine whether CrowdStrike Falcon is present. If Falcon is detected, CountLoader modifies its execution chain to launch mshta.exe indirectly via cmd.exe /c start /b. In environments where Falcon is not detected, it communicates directly with its C2 using mshta.exe.

Enhancements in CountLoader Version 3.2

Version 3.2 significantly expands the loader’s functionality, introducing enhanced host profiling and more flexible payload-delivery options. Notable capabilities include:

  • USB-based propagation, achieved by planting malicious shortcut files alongside hidden legitimate files, causing both to execute upon user interaction.
  • In-memory execution through mshta.exe or PowerShell to minimize on-disk artifacts.
  • Multi-format payload delivery, supporting standalone executables, ZIP archives containing Python modules or EXEs, DLLs executed via rundll32.exe, and MSI installers.
  • System reconnaissance and data exfiltration.
  • Remote command execution, including memory-resident PowerShell scripts and mshta-based commands.
  • Self-cleanup routines, allowing removal of the scheduled task to reduce forensic visibility.

Campaign Objective

In the activity analyzed by Cyderes, the final payload deployed by CountLoader was ACR Stealer, an information-stealing malware designed to collect sensitive data from compromised systems.

This campaign highlights the ongoing risks associated with pirated software and demonstrates the increasing sophistication of modern malware delivery chains. Defensive measures should include restricting software installation to trusted sources and maintaining up-to-date endpoint security controls.

References: