OnionDrop Loader Uses gainmsg C2 to Deliver LegionLoader Payloads

Key Takeaways

• A new, highly sophisticated loader, dubbed OnionDrop, is actively delivering multiple malware payloads, including LegionLoader, CGrabber, and Vidar Stealer.
• The campaign has been ongoing since at least February 2026, with over 645 unique malicious DLL samples identified in approximately 80 days.
• OnionDrop utilizes a multi-stage infection process, advanced anti-analysis techniques, and a gainmsg command-and-control (C2) infrastructure.
• Its evasion capabilities are considered by researchers to rival those typically found in nation-state-sponsored tools.

OnionDrop Loader Campaign Leverages gainmsg C2 for Multi-Stage Malware Delivery

A sophisticated new loader campaign, named OnionDrop, has emerged, actively deploying a range of potent malware, including LegionLoader (also known as CurlyGate), CGrabber Infostealer, and Vidar Stealer. This operation, which has been active since at least February 2026, employs a multi-stage infection chain and a gainmsg command-and-control (C2) infrastructure to distribute its malicious payloads at scale.

In a detailed report shared with Cyber Security News (CSN), threat researchers from Cyderes’ Howler Cell Threat Research Team have identified OnionDrop as the third distinct component in a broader malicious campaign they have been tracking, following earlier observations of CGrabber Infostealer and Direct-sys Loader operations. The researchers highlighted the loader’s exceptional technical sophistication, noting that its evasion architecture is comparable to, and in some aspects surpasses, the capabilities typically observed in advanced nation-state tooling.

Over 645 unique malicious DLL samples associated with OnionDrop have been detected in roughly 80 days, indicating a high operational tempo. The campaign remains active, posing a persistent and evolving threat that demands immediate attention from cybersecurity defenders.

The Attack Chain: From ZIP to Shellcode

The infection process for OnionDrop begins when victims interact with a ZIP archive. This archive contains a legitimate, Adobe-signed executable, frequently named “AcroBroker.exe” or “setup.exe.” Alongside this trusted binary are two malicious DLLs: “sqlite.dll” and “codecstore384d.dll.” To further complicate analysis and potentially bypass some security checks, the archive also includes a 100MB decoy file named “data.bin,” which is filled with random bytes to artificially inflate the archive’s size.

Upon execution of the legitimate Adobe binary, the “sqlite.dll” is sideloaded. This malicious DLL then loads the primary malicious DLL, “codecstore384d.dll,” which contains the core OnionDrop logic. From this point, OnionDrop embarks on a complex four-stage unpacking process designed to thwart both automated sandbox analysis and manual reverse engineering efforts:

1. Custom Byte-Pair Decoding: An initial layer of obfuscation.
2. Xpress Huffman Decompression: Standard compression techniques used to hide malicious code.
3. AES-256-CBC Decryption: Utilizes strong encryption with rotating key material, making static analysis extremely difficult.
4. Shellcode Execution via Thread Pool Callback Abuse: The final stage involves executing shellcode by abusing the Windows Thread Pool’s TpPostWork function, a technique that often bypasses conventional thread-creation telemetry relied upon by security tools.

Once the unpacking stages are complete, the final payload is delivered. In the observed instances, this has included LegionLoader, which then decrypts its RC4-encrypted configuration and establishes communication with its command-and-control server located at gainmsg[.]com/nfront[.]php. This C2 infrastructure facilitates the exfiltration of stolen data and the reception of further instructions from the threat actors.

Advanced Evasion Techniques

OnionDrop distinguishes itself from typical commodity loaders through its sophisticated anti-analysis features, which demonstrate a significant investment in operational security by the threat actor:

• Stack-String Construction: Sensitive function names are not stored in a readable format but are constructed dynamically on the stack at runtime. This makes it challenging for static analysis tools to identify malicious API calls.
• API Hammering: The loader generates a large volume of irrelevant API calls, flooding sandbox traces and making it difficult for automated systems to discern legitimate system interactions from malicious ones.
• Environment Awareness: Before executing its core malicious logic, OnionDrop performs checks on the system’s display device name. It verifies if the system’s GPU string matches expected values like INTEL, AMD, RADEON, or NVIDIA. If the system appears to be a virtual environment or sandbox with a non-standard display adapter, the malware immediately terminates execution, preventing analysis in controlled environments.
• Donut-Generated Payloads: The final shellcode is generated using Donut, a tool that creates position-independent shellcode from .NET assemblies, VBS, JS, EXE, and DLL files, further complicating detection.

The combination of these techniques, including rotating AES key material across execution stages, highlights a deeply engineered evasion stack. This level of sophistication suggests a well-resourced and highly organized threat actor behind the OnionDrop campaign, capable of running multiple infostealer operations simultaneously without signs of abatement.

What You Should Do

• Monitor for IoCs: Actively monitor your network and endpoints for the provided Indicators of Compromise (IoCs), including file hashes and C2 domains.
• Block C2 Communications: Implement firewall rules and network security policies to block connections to known command-and-control domains, such as gainmsg[.]com/nfront[.]php.
• Enhance Endpoint Detection: Update endpoint detection and response (EDR) rules to specifically flag and prevent DLL sideloading behaviors, particularly those involving legitimate Adobe-signed executables contained within ZIP archives.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of opening suspicious ZIP archives or executing unknown files, even if they appear to contain legitimate software.
• Implement Application Whitelisting: Consider implementing application whitelisting to restrict the execution of unauthorized executables and DLLs on critical systems.
• Regularly Back Up Data: Maintain regular, offsite backups of critical data to mitigate the impact of potential data exfiltration or system compromise.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.