OysterLoader: Multi-Stage Loader Evolves to Evade Detection and Deliver Ransomware

Sekoia TDR analyzed OysterLoader (aka Broomstick/CleanUp), a C++ multi-stage malware loader distributed as fake installers that employs heavy API-call noise, anti-debugging, a custom LZMA compression variant, steganographic payload delivery inside images, and a dual-layer C2 using a non-standard Base64 with per-message random shifts; the report links it to cybercriminal operations including the Rhysida ransomware group and highlights active maintenance and evolving evasion techniques.