{"id":228848,"date":"2026-05-13T03:00:36","date_gmt":"2026-05-13T10:00:36","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=228848"},"modified":"2026-05-07T12:12:08","modified_gmt":"2026-05-07T19:12:08","slug":"sinkholing-countloader-insights-into-its-recent-campaign","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/sinkholing-countloader-insights-into-its-recent-campaign\/","title":{"rendered":"Sinkholing CountLoader: Insights into Its Recent Campaign"},"content":{"rendered":"

Authored\u00a0<\/span>by Harshil Patel and\u00a0<\/span>Sakshi<\/span>\u00a0<\/span>Jaiswal<\/span><\/span>\u00a0<\/span><\/em><\/p>\n

McAfee Labs has recently uncovered a large scale\u00a0<\/span>CountLoader<\/span>\u00a0campaign that uses multiple layers of obfuscation and staged payload delivery to evade detection and\u00a0<\/span>maintain<\/span>\u00a0persistence\u00a0<\/span>in<\/span>\u00a0infected systems. The infection process relies on several layers of loaders, including PowerShell scripts, obfuscated JavaScript executed through mshta.exe, and in memory shellcode injection, each stage decrypting and launching the next. The attackers\u00a0<\/span>employ<\/span>\u00a0a custom encrypted communication protocol to interact with their C2 servers. By registering a backup domain used by the malware, we were able to sinkhole the traffic and\u00a0<\/span>observe<\/span>\u00a0thousands of infected machines connecting to the<\/span>\u00a0C2<\/span>\u00a0infrastructure.<\/span>\u00a0F<\/span>inal payload deployed in this campaign is a cryptocurrency clipper, which\u00a0<\/span>monitors<\/span>\u00a0clipboard activity and replaces copied wallet addresses with\u00a0<\/span>attacker controlled<\/span>\u00a0ones to redirect cryptocurrency transactions.<\/span><\/span>\u00a0<\/span><\/p>\n

Sinkholing<\/span>\u00a0<\/span><\/h2>\n

Sinkholing\u00a0is a defensive technique in which researchers take control of malicious domains or infrastructure used by malware. Instead of allowing infected systems to communicate with attacker controlled C2 servers, the traffic is redirected to a\u00a0researcher controlled\u00a0server.\u00a0This approach enables researchers to\u00a0monitor\u00a0infected hosts, collect telemetry,\u00a0measure\u00a0the\u00a0scale\u00a0and spread of a campaign.<\/span>\u00a0<\/span><\/p>\n

Key\u00a0Findings<\/span>\u00a0<\/span><\/h2>\n