The Squirrelwaffle: New Loader Delivers Cobalt Strikes

Zscaler ThreatLabz analyzed an active Squirrelwaffle loader campaign (since mid‑September 2021) that uses email thread hijacking and malicious Word/Excel documents with macros to drop VBS/PowerShell stagers which fetch a packed DLL executed via rundll32/regsvr32; the loader contains XOR‑obfuscated C2 configuration, communicates using Base64+XOR over HTTP(S), can fetch a second‑stage executable that unpacks a Cobalt Strike stager/beacon, and the report provides extensive IOCs (URLs, domains, IPs, and MD5 hashes) and MITRE ATT&CK mappings.