Krustyloader

Malware Profile Updated a month ago
Download STIX
Preview STIX
KrustyLoader is a type of malware that poses a significant threat to computer systems and devices. This malicious software is specifically designed to exploit and damage your computer or device, often infiltrating your system through suspicious downloads, emails, or websites without your knowledge. Once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. The deployment of KrustyLoader has been linked to the exploitation of bugs in Ivanti VPN, as reported by various sources. Threat actors have identified and utilized these vulnerabilities to deliver the harmful KrustyLoader malware into unsuspecting systems. The Ivanti VPN bugs serve as a gateway for the malware, allowing it to bypass security measures and establish itself within the targeted system. This situation underscores the importance of continuous cybersecurity vigilance and the need for regular system updates and patches. Users of Ivanti VPN are advised to update their software to the latest version to mitigate the risk of KrustyLoader infection. Furthermore, adopting robust security practices such as avoiding suspicious downloads, emails, and websites can also help protect against this and other forms of malware.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Sliver
2
Sliver is an open-source, cross-platform tool created by Senior Security Associate Joe DeMesy and Security Associate Ronan Kervella. It was introduced at SummerCon in June 2019 and is currently in beta. Sliver supports command and control (C2) over Mutual-TLS, HTTP(S), and DNS and can be used as par
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Backdoor
Ivanti
Malware
Vpn
Exploit
Sliver
Zero Day
Linux
Gbhackers
State Sponso...
Loader
Windows
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CVE-2024-21887Unspecified
2
CVE-2024-21887 is a command injection vulnerability identified in the web components of Ivanti Connect Secure and Ivanti Policy Secure (versions 9.x and 22.x). This flaw was publicly disclosed on January 10, 2024, alongside an authentication bypass vulnerability (CVE-2023-46805), affecting the same
CVE-2023-46805Unspecified
2
CVE-2023-46805 is a significant software vulnerability discovered in the web component of all supported versions of Ivanti Connect Secure and Ivanti Policy Secure (versions 9.x and 22.x). This flaw, which allows for authentication bypass, was first brought to the attention of the Cyber Centre on Jan
Source Document References
Information about the Krustyloader Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
Securityaffairs
6 days ago
Security Affairs Malware Newsletter - Round 3
Securityaffairs
6 days ago
Security Affairs Malware Newsletter - Round 3
Securityaffairs
12 days ago
Security Affairs Malware Newsletter - Round 2
Securityaffairs
20 days ago
Security Affairs Malware Newsletter - Round 1
Securityaffairs
a month ago
Security Affairs newsletter Round 478 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
a month ago
Security Affairs newsletter Round 477 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
a month ago
Security Affairs newsletter Round 476 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
2 months ago
Security Affairs newsletter Round 473 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
3 months ago
Security Affairs newsletter Round 470 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
3 months ago
Security Affairs newsletter Round 469 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
3 months ago
Security Affairs newsletter Round 467 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs
4 months ago
Security Affairs newsletter Round 466 by Pierluigi Paganini
Securityaffairs
4 months ago
Security Affairs newsletter Round 465 by Pierluigi Paganini
Securityaffairs
4 months ago
Security Affairs newsletter Round 464 by Pierluigi Paganini
CERT-EU
4 months ago
SUSE: 2024:0912-1 important: openvswitch | LinuxSecurity.com
Securityaffairs
4 months ago
Security Affairs newsletter Round 463 by Pierluigi Paganini
CERT-EU
4 months ago
Mageia 2024-0069: jackson-databind security update | LinuxSecurity.com
CERT-EU
4 months ago
Mageia 2024-0067: jupyter-notebook security update | LinuxSecurity.com
CERT-EU
4 months ago
SUSE: 2024:0908-1 moderate: 389-ds | LinuxSecurity.com
CERT-EU
4 months ago
Mageia 2024-0061: java 1.8.0, 11 & latest security update | LinuxSecurity.com