Empire Downloader

Internal ID: win.empire_downloader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.empire_downloader. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Empire Downloader is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.secureworks.com/research/threat-profiles/gold-burlap

→http://www.secureworks.com/research/threat-profiles/gold-heron

→https://attack.mitre.org/groups/G0096

→https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html

→https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/

→https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf

→https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_1_9_takeda_furukawa_en.pdf

→https://lab52.io/blog/wirte-group-attacking-the-middle-east/

→https://paper.seebug.org/1301/

→https://redcanary.com/blog/getsystem-offsec/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.empire_downloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Empire Downloader