EugenLoader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A loader written in Powershell, usually delivered packaged in MSI/MSIX files.

Threat Analysis

EugenLoader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/

→https://esentire-dot-com-assets.s3.amazonaws.com/assets/resourcefiles/eSentire-Unraveling_BatLoader_and_FakeBat.pdf

→https://intel471.com/blog/malvertising-surges-to-distribute-malware

→https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-NUMOZYLOD-with-Google-Security/ba-p/789551

→https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

EugenLoaderFakeBatps1.eugenloaderNUMOZYLODPaykLoader

External Intelligence

Malpedia: ps1.eugenloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search EugenLoader