A new Malware-as-a-Service (MaaS) threat, Olymp Loader, has emerged on underground forums and Telegram, with its first appearance documented on June 5, 2025. The threat actor, operating under the alias “OLYMPO”, presents the malware as a sophisticated tool, claiming it is "FULLY IN ASSEMBLY" language. This claim, highlighted in their forum advertising banners, is a key marketing tactic to attract a cybercriminal clientele that associates assembly language with low-level, high-performance code that is inherently difficult for security products to detect and for analysts to reverse-engineer.
The seller, who claims to be part of a team with over 10 years of experience in Assembly programming, markets Olymp Loader as FUD (Fully UnDetectable) [1]. This is a central part of their value proposition, with advertisements boasting a 1/72 detection rate on VirusTotal (VT). Despite its recent arrival, the MaaS has already garnered numerous positive reviews from users in the cybercriminal community.
Olymp Loader functions as a multi-purpose threat:
This combination of features, packaged as an easy-to-use MaaS, lowers the barrier to entry for low- and mid-tier cybercriminals, enabling them to leverage sophisticated evasion techniques and rapidly deploy attacks.
Activity has been observed on the following sites under various usernames:
|
Site Username Registration Date |
A notable "content-marketing" strategy was employed on the top-tier XSS forum. Instead of a direct sales thread, technical articles detailing the loader's inner workings were posted. This unconventional approach was likely intended to build credibility as a malware developer and attract technically skilled members [1].
5 Jun 2025: First advertisement in HackForums. (This marks the public launch of the project)
2 Jul 2025: UI, botnet features, and shellcode update. (Represents the peak of its expansion as a botnet)
3 Aug 2025: Project restructured. From botnet to dropper. (A fundamental pivot in the malware's architecture and purpose)
30 Aug 2025: Multiservice: stager generator, botnet, file scanner, and crypt. (Shows the project's evolution into a broader service platform)
A significant pivot was announced on August 3, 2025, detailing a major restructuring that shifted the project from a botnet to a dropper/loader.
An announcement stated [1]:
|
OLYMP -- Making FUD
|
Several methods are used to distribute the Olymp Loader.
Two loader binaries were observed hosted as assets within GitHub Releases. The repository, named PurpleOrchid65/Testing, used names like "NodeJs.exe" and a "/NodeJs/" folder path. This suggests a campaign targeting developers attempting to download the Node.js runtime environment from GitHub.
The malware is also distributed using URLs with file names and paths designed to mimic legitimate software. This social engineering technique leverages well-known names to trick users into downloading the malware. Observed lures include PuTTY (SSH client), OpenSSL(cryptographic library), Zoom (video conferencing app), or Classic Offensive (fan-made Counter-Strike mod) [1].
After successful execution, Olymp clients are predominantly observed deploying credential infostealers and remote-access tools. Utilities designed to weaken local defenses are often run first.
The breakdown of delivered payloads is as follows [1]:
The OLYMPO-related products have evolved continuously. Olymp Loader itself has received multiple updates since its first release.
The behavior of these early samples can be summarized as follows [1]:
The process flow and commands are illustrated below:
Initial Execution: %Desktop%\test.exe
|
cmd.exe /C "timeout /T 30 >nul && copy /Y "C:\Users\<USER>\Desktop\test.exe" "C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe" && start "" "C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe" |
Persistence Script:
|
powershell -ExecutionPolicy Bypass -w hidden -command "$app[0-9]{5}=[Environment]::GetFolderPath([Environment+SpecialFolder]::ApplicationData);Start-Sleep -Seconds 60;$ws = New-Object -ComObject WScript.Shell;$lnk = $ws.CreateShortcut($app[0-9]{5}+ '\Microsoft\Windows\Start Menu\Programs\Startup\[0-9]{4}.lnk');$lnk.TargetPath = '"C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe"';$lnk.Save()" |
Execution from New Location: %AppData%\[0-9]{4}.exe
|
C:\Windows\SysWOW64\cmd.exe /c "timeout /t 60 /nobreak >nul && start "" "C:\Users\user\AppData\Roaming\[0-9]{4}.exe" |
Following the August 3 restructuring, botnet functions were removed. The payload was encrypted and integrated directly into the stub, set to execute immediately after Windows Defender was disabled.
The updated behavior is as follows [1]:
Initial Execution: %Desktop%\test.exe
|
cmd.exe /c "timeout /T 5 >nul && copy /Y "C:\Users\<USER>\Desktop\test.exe" "C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe" && start "" "C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe"" |
Persistence Script:
|
powershell.exe -w hidden -command "$app3753 = [Environment]::GetFolderPath([Environment+SpecialFolder]::ApplicationData);Start-Sleep -Seconds 60;$ws = New-Object -ComObject WScript.Shell;$lnk = $ws.CreateShortcut($app[0-9]{4} + 'Microsoft\Windows\Start Menu\Programs\Startup\[a-z]{4}.lnk');$lnk.TargetPath = '"C:\Users\<USER>\AppData\Roaming\[0-9]{4}.exe"';$lnk.Save()" |
Execution from New Location: %AppData%\[0-9]{4}.exe
This execution triggers a series of PowerShell commands to disable Windows Defender's real-time monitoring and other protections:
|
powershell.exe powershell -NoProfile -Command "Set-MpPreference -DisableScanningNetworkFiles $true" |
Subsequently, two executables are dropped into the Temp directory. A series of commands are then run, apparently leveraging the "Defender Remover" tool, which is publicly available on GitHub. This toolset includes PowerRun.exe, various .reg files, and PowerShell scripts to remove Defender components.
|
cmd.exe /c "C:\Users\<USER>\AppData\Local\Temp\_MEI*\data\PowerRun.exe regedit.exe /s C:\Users\<USER>\AppData\Local\Temp\_MEI*\data\Remove_SecurityComp.reg" |
This functionality changed again just days later, removing the explicit Defender-disabling commands. Samples from August 10, 2025, instead contained a much longer list of directories to be added to the exclusion list, including %APPDATA%, %LOCALAPPDATA%, %DESKTOP%, %MYDOCUMENTS%, and others.
As of June 23, 2025, three distinct stealing modules were offered as part of the loader's initial advertisement. A common feature across all analyzed modules is an embedded proxy URL used for data exfiltration, located at the end of the binary. The binary searches its own content for a __PROXY__ marker, which is immediately followed by the URL.
|
__PROXY__http://144.172.97[.]30/index.php |
This module, internally named tgsteal.py, is written in Python. Its behavior involves [1]:
The browser stealer is written in Python and compiled using "Nuitka". A notable artifact is a DLL named "brsteal.dll" found in the temporary Nuitka directory (%temp%\onefile_). This DLL's name strongly suggests it is the advertised browser stealer module.
Another stealer was identified, written in C++ and containing references to "shaddy43". This username is associated with a GitHub profile that hosts an open-source C++ browser stealer repository. A comparison reveals that the C++ module used by Olymp is based on this open-source BrowserSnatch code but has been modified to include an almost doubled target list [1].
This stealer module targets a specific list of desktop cryptowallets, including Exodus, Electrum, Atomic, Guarda, Wasabi, Monero, BitcoinCore, and ZelCore. It also captures a screenshot of all monitors. It is highly probable that this module is also written in Python [1].
We also strongly suggest simulating Olymp Loader Campaign Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Security Validation Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for the Olymp Loader Campaign:
|
Threat ID |
Threat Name |
Attack Module |
|
68218 |
Olymp Loader Email Threat |
E-mail Infiltration |
|
98173 |
Olymp Loader Download Threat |
Network Infiltration |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.
References
[1] L. L. Sanz, “Olymp Loader: A new Malware-as-a-Service written in Assembly,” Outpost24. Accessed: Nov. 13, 2025. [Online]. Available: https://outpost24.com/blog/olymp-loader-a-new-malware-as-a-service/