Description
TurtleLoader is a loader written in C that researchers have tracked since 2022 delivering payloads such as QakBot, SquirrelWaffle, and ransomware tooling through phishing lures. It runs obfuscated code to hamper analysis, and its operators have used it as an early stage in intrusion chains that end in extortion.
Stats
- First seen
- March 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| ByteCode-MSIL.Backdoor.TurtleLoader |
| ByteCode-MSIL.Trojan.TurtleLoader |
| Document-XML.Backdoor.TurtleLoader |
| Script.Backdoor.TurtleLoader |
| Win32.Trojan.TurtleLoader |
| Win64.Backdoor.TurtleLoader |
| Win64.Trojan.TurtleLoader |
