Common Malware Loaders

ReliaQuest's 2024 malware loader report warns that loaders appeared in nearly 40% of critical incidents, with SocGholish, GootLoader, and Raspberry Robin driving most activity; it documents evolving loader techniques (fileless execution, Python-based persistence, DLL side-loading, obfuscation, Tor C2 and one-day exploits), provides IoCs and a SocGholish case study, and offers detection and mitigation guidance for defenders.