Malware
DOUBLELOADER Malware Uses ALCATRAZ Obfuscation – What Defenders Need to Know
Elastic Security Labs uncovered DOUBLELOADER, a backdoor that uses the ALCATRAZ obfuscator and ships with the RHADAMANTHYS infostealer. The malware injects into explorer.exe, gathers system data, and beacons to a hard‑coded IP. Defenders should scan for the .0Dev section, use de‑obfuscation tools, and block outbound traffic to the beacon address.
What Happened
Elastic Security Labs identified a new backdoor family, DOUBLELOADER, that ships with the RHADAMANTHYS infostealer. The binaries are obfuscated with the open‑source tool ALCATRAZ, first released in 2023, and contain a non‑standard .0Dev section that signals the use of the obfuscator.
Impact
DOUBLELOADER drops into explorer.exe, uses NtOpenProcess, NtWriteVirtualMemory, and NtCreateThreadEx to inject code, gathers host information, and contacts a hard‑coded beacon address (185.147.125.81). The obfuscation hides control flow, constants, and entry points, making static analysis difficult and delaying incident response.
What to Do
- Scan for the .0Dev section and the beacon IP in binaries.
- Use the Elastic Security Labs de‑obfuscation toolkit to flatten control flow and reveal hidden constants.
- Monitor for the specific syscalls and process injection patterns used by DOUBLELOADER.
- Apply network segmentation and restrict outbound traffic to known IPs to block beaconing.
Tools & Mitigation
Elastic Security Labs released a de‑obfuscation utility that can be run against ALCATRAZ‑protected binaries. The tool automatically expands constant folding, removes LEA tricks, and reconstructs the original control flow graph.
Related articles
DYNOWIPER Wiper Attack on Poland’s Energy Infrastructure: What SecOps Need to Know
A coordinated destructive campaign on 29 Dec 2025 deployed the DYNOWIPER wiper against Poland’s renewable energy farms and a major CHP plant, wiping data from Windows systems. Defenders must patch exposed Fortinet devices, enforce MFA, and deploy canary file monitoring to detect and stop the malware.
Read briefing
Elastic Security Labs Releases NETWIRE Configuration Extractor to Aid Detection
Elastic Security Labs has released a free tool that dynamically extracts encrypted configuration data from the NETWIRE RAT, a malware variant that has risen in prevalence since 2022. The extractor uses YARA and Capstone to locate RC4 keys and decrypt payloads, enabling defenders to expose C2 endpoints and credentials quickly.
Read briefing
REMCOS RAT 2024: Watchdog Persistence and Offline Keylogger Mechanisms
The 2024 REMCOS RAT uses a watchdog process to maintain persistence and a low‑profile offline keylogger that writes to a predictable AppData path. Defenders should monitor for injected svchost.exe or rmclient.exe processes, check HKCU\SOFTWARE\{MUTEX}\WD registry entries, and look for keylogger.dat files in %APPDATA%. Early detection can prevent data exfiltration and process restarts.
Read briefing
Macfinger ClickFix delivers architecture‑specific info‑stealer via shell‑script loader
A macOS 27.0 machine was infected by the Macfinger ClickFix campaign, which uses a shell script to download an architecture‑specific binary that steals credentials and persists in the user cache. The payload runs as com.apple.periodic and can survive reboots. Defenders should block the attacker IP, monitor the cache directory, and terminate any com.apple.periodic processes.
Read briefing