MALWARE FAMILY

KrustyLoader

Internal ID: elf.krustyloader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

ELF x64 Rust downloader first discovered on Ivanti Connect Secure VPN after the exploitation of CVE-2024-21887 and CVE-2023-46805. Downloads Sliver backdoor and deletes itself.

Threat Analysis

KrustyLoader is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

→https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/dragons-in-thunder/

→https://nofix.re/posts/2024-08-03-arti-rust/

→https://nofix.re/posts/2024-11-02-rust-symbs/

→https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.krustyloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search KrustyLoader