APT / THREAT GROUP

BATLOADER

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to PCrisk, BATLOADER is part of the infection chain where it is used to perform the initial compromise. This malware is used to execute payloads like Ursnif. Our team has discovered BATLOADER after executing installers for legitimate software (such as Zoom, TeamViewer Visual Studio) bundled with this malware. We have found those installers on compromised websites.

Threat Analysis

BATLOADER is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html

→https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle

→https://intel471.com/blog/malvertising-surges-to-distribute-malware

→https://medium.com/walmartglobaltech/revisiting-batloader-c2-structure-52f46ff9893a

→https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.bat_loaderBATLOADER

External Intelligence

Malpedia: win.bat_loader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BATLOADER