HOMETHREATSsLoad
APT / THREAT GROUP

sLoad

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features. The malware gathers information about the infected system including a list of running processes, the presence of Outlook, and the presence of Citrix-related files. sLoad can also take screenshots and check the DNS cache for specific domains (e.g., targeted banks), as well as load external binaries.

Threat Analysis

sLoad is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.minerva-labs.com/sload-targeting-europe-again
→https://blog.yoroi.company/research/the-sload-powershell-threat-is-expanding-to-italy/
→https://cert-agid.gov.it/news/campagna-sload-v-2-9-3-veicolata-via-pec/
→https://cyware.com/news/new-sload-malware-downloader-being-leveraged-by-apt-group-ta554-to-spread-ramnit-7d03f2d9
→https://isc.sans.edu/forums/diary/Malicious+Powershell+Targeting+UK+Bank+Customers/23675/

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

sLoadps1.sloadStarslord

External Intelligence

Malpedia: ps1.sload

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search sLoad