Sauron Loader (DCSO CyTec): ClickFix/vishing → DLL side-load (rnpkeys) loader sold to RU-speaking buyers — Germany incidents
DCSO CyTec (Medium, 24 September 2026) documents Sauron Loader, a previously undocumented Windows loader seen as the final stage in multiple recent German customer engagements. Delivery chains used ClickFix-style lures and voice phishing (spam flood then fake IT-support callback). An analyzed MSI (SHA-256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2) side-loads via legitimate rnpkeys.exe loading malicious rnp.dll / tdwp.dll, decrypts the loader in memory, persists with a keyroll scheduled task, and talks C2 over encrypted HTTPS with changing paths (Salsa20 + RSA per research).
Capabilities: host fingerprint, download/execute varied payloads (EXE/DLL/MSI/scripts), screenshot exfil. Underground alias S4ur0n advertised the loader to Russian-speaking buyers with claimed restrictions on public-sector / post-Soviet targets — not proof of operator attribution for the German cases. IoCs and tooling on DCSO GitHub (Blog_CyTec). Primary: DCSO CyTec Medium; GitHub companion artifacts.
- Product
- Sauron Loader (Windows malware loader; MSI + rnpkeys.exe DLL side-load)
- Versions
- n/a (malware family; analyzed MSI SHA-256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2)
- Exploited in Australia?
- unknown
- Patch to
- No vendor patch — detect and block. Hunt: unexpected rnpkeys.exe loading adjacent rnp.dll/tdwp.dll; keyroll scheduled task; ClickFix/vishing IT-support callbacks after spam floods; MSI installs from untrusted mail; DCSO GitHub YARA/IoCs. User awareness on fake IT remote-assistance and ClickFix paste prompts.