APT / THREAT GROUP

KrustyLoader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ELF x64 Rust downloader first discovered on Ivanti Connect Secure VPN after the exploitation of CVE-2024-21887 and CVE-2023-46805. Downloads Sliver backdoor and deletes itself.

Threat Analysis

KrustyLoader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

→https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/

→https://nofix.re/posts/2024-08-03-arti-rust/

→https://nofix.re/posts/2024-11-02-rust-symbs/

→https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

elf.krustyloaderKrustyLoader

External Intelligence

Malpedia: elf.krustyloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KrustyLoader