June 14, 2025
Ransomware isn’t just about encryption anymore. Today’s most dangerous attacks begin long before the ransom note appears. Instead of crashing through the front door, threat actors are quietly slipping in the back, using modular tools like Skitnet and TransferLoader to silently map systems, steal credentials, and plant malware in stages. These advanced loaders and backdoors are turning corporate networks into slow-burning fuse lines, setting the stage for devastating, full-scale ransomware detonation. In this post, we break down how Skitnet and TransferLoader operate, why they're so hard to detect, and what cybersecurity teams must do to stop them before it’s too late. 1. From Stealth to Siege: Skitnet Malware What it is: Skitnet (also known as Bossnet) is a modular, multi-stage malware marketed on underground forums like RAMP since April 2024. Swiss firm PRODAFT observed its increasing use by ransomware gangs such as Black Basta, Cactus, and others throughout early 2025 (thehackernews.com, zscaler.com). How it works: Initial loader: A Rust-based binary decrypts a Nim payload in memory. Communication: The Nim payload establishes a DNS-based reverse shell via dynamic GetProcAddress resolution and threading, sneaking past detection every ~10 seconds (scworld.com, logstail.com). Commands: Allows persistence, screenshots, AV enumeration, installation of remote tools (AnyDesk, RUT‐Serv), PowerShell script execution, and additional payload downloads like .NET loaders (thehackernews.com). Why it's worrying: With plugins for credential theft, lateral movement, and ransomware, Skitnet primes environments for full-scale attacks long before encryption begins (csoonline.com). 2. A Sneaky Enabler: TransferLoader Overview: Identified by Zscaler’s ThreatLabz and others, TransferLoader is a sophisticated loader active since at least February 2025. It has been used to deploy Morpheus ransomware, notably against a U.S. law firm (zscaler.com). Modular design: Downloader: Fetches malicious payloads while displaying harmless decoy PDFs. Backdoor loader: Manages decryption and execution of the backdoor component. Backdoor: Enables arbitrary remote command execution and updates configuration. Evasion techniques: Implements heavy anti-analysis: dynamic API resolution via hashing, PEB debugging checks, dynamic string decryption, control-flow obfuscation (jump address modification, SIMD instruction tricks), and filename checks (logstail.com, zscaler.com). Resilient communication: If primary C2 is down, the backdoor falls back to IPFS (InterPlanetary File System) to fetch updates – bypassing takedown efforts (zscaler.com). 3. The Playbook: How These Tools Work Together Initial compromise A phishing email drops Skitnet or TransferLoader, initiating DNS-based communication and stealthy reconnaissance. Lateral movement & persistence Skitnet’s DNS shell paves the way for deeper infiltration. TransferLoader secures foothold and flexes its backdoor to execute commands silently. Payload delivery TransferLoader delivers Morpheus or other ransomware variants; meanwhile, Skitnet continues to harvest data, credentials, or escalate privileges. Ransomware detonation Once systems are weaponized, attackers move to encrypt or exfiltrate critical files, demanding ransom. 4. What It Means for Cybersecurity Teams Stealth communications matter DNS-based C2 and IPFS-fallback mechanisms bypass common detection channels, so monitoring for unusual DNS traffic or IPFS requests is critical. Defeat the loader architecture Detect dynamic API resolution or memory-based decryption, routine EDR and antivirus may not catch these evasive techniques. Modular chain detection Alerts for one stage (e.g., DNS shell) should trigger deeper inspections, early detection disrupts the ransomware kill chain. IT hygiene matters Enforce multi-factor authentication, patch systems vigorously, tighten controls on PowerShell usage and remote tools like AnyDesk. 5. Defending Against This Wave; Strategy and Why It Helps DNS and IPFS monitoring - Identifies stealth C2 traffic early Behavioral EDR - Detects in-memory decryption, dynamic API usage PowerShell hardening - Blocks misuse for persistence and control Network segmentation - Limits lateral movement and credential abuse Threat intelligence feeds - Keep IOCs and TTPs up to date (e.g., multiple C2 domains, backdoor indicators) The rise of Skitnet and TransferLoader highlights a troubling trend in ransomware: modular, stealthy pre-encryption frameworks that deeply infiltrate networks before detonating. These aren't simple "encrypt and demand" tools, they're multi-stage instruments of sustained compromise. Defenders must adopt a layered approach: detect stealth communications, analyze behavioral anomalies, and thwart loaders before they deploy payloads. In today’s landscape, stopping the infection early means the difference between a blocked threat and a catastrophic breach. Sources: Detailed analysis of Skitnet behavior, DNS-based C2, and ransomware toolkits (thehackernews.com, impresscomputers.com, linkedin.com, hivepro.com, pcrisk.com, csoonline.com, linkedin.com, scworld.com, stratosally.com) Zscaler, GBHackers, SC Media, and Gurucul insights into TransferLoader’s loader-backdoor ransomware pipeline, evasion tactics, and IPFS fallback (zscaler.com)