Larva-25012 Resumes Proxyware Distribution Using DPLoader on Infected Systems
Summary
AhnLab reports that Larva-25012 resumed distributing DigitalPulse, SOAX, Appsalt, and IPRoyal proxyware by using DPLoader on already-infected systems, with PowerShell scripts installing the software and creating scheduled tasks.
Key points
- The campaign abuses infected systems' internet bandwidth to generate revenue for the threat actor without users' consent.
- DPLoader, usually its JavaScript version, collects system information, contacts a C2 server, and can execute PowerShell commands returned by the server.
- PowerShell scripts install proxyware and create scheduled tasks; the DigitalPulse script also attempts to disable Microsoft Defender.
- Observed proxyware includes DigitalPulse, SOAX, Appsalt, and IPRoyal, sometimes deployed with loaders and SDK DLLs.
- Earlier distribution methods included pop-up ads on video-download sites, a fake Steam cleanup tool on GitHub, and illegal software crack-download pages.
- AhnLab says many systems in Korea have been targeted and advises avoiding suspicious downloads and using its V3 product on infected systems.
Article Details
- Attack Vectors
- ASEC believes the renewed distribution uses DPLoader already present on infected systems rather than a new initial infection method.
- Earlier distribution used pop-up advertisements on free YouTube download sites, a purported Steam client cleanup tool on GitHub, and illegal software crack download pages.
- DPLoader receives commands from its C&C server and executes PowerShell scripts that install proxyware.
- Some installations pair proxyware SDK DLLs with loaders that initialize the SDK using the threat actor's token, directing bandwidth-sharing revenue to the actor.
- Defensive Notes
- Avoid installing executables from suspicious advertising, pop-up, crack-download, or file-sharing sites; obtain software from official websites.
- ASEC recommends installing a V3 product on infected systems to prevent further malware infections.
- Reported persistence task names include PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate, and BackgroundTaskRegistrationMaintenanceTaskScheduler.
- The DigitalPulse installation script disables Microsoft Defender.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 0066422310c880d5e722ba59ad315df1 | Artifact hash listed in the article's proxyware-distribution IOC section; the specific component is not disclosed. |
| MD5 | 10498a91dcb16561e32487a47b9832f7 | Artifact hash listed in the article's proxyware-distribution IOC section; the specific component is not disclosed. |
| MD5 | 1fdf8668882272280f1b53b4443a4906 | Artifact hash listed in the article's proxyware-distribution IOC section; the specific component is not disclosed. |
| MD5 | 286380d04f0d5a9f800a2b6cb23e080a | Artifact hash listed in the article's proxyware-distribution IOC section; the specific component is not disclosed. |
| MD5 | 2e73e08b1e9a3edd3dfa024040b9467e | Artifact hash listed in the article's proxyware-distribution IOC section; the specific component is not disclosed. |
| URL | hxxp[:]//7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e | C&C endpoint receiving execution results or error logs from the SOAX installation script. |
| URL | hxxp[:]//d6nue5fz4t6y8[.]cloudfront[.]net/9083743654554665[.]Ps1 | Hosted PowerShell script used to install Appsalt proxyware. |
| URL | hxxp[:]//dci6j1p0q6khn[.]cloudfront[.]net/784365567456345[.]Ps1 | Hosted PowerShell script used to install IPRoyal proxyware. |
| URL | hxxp[:]//dhrciu5akloar[.]cloudfront[.]net/63563545600333[.]Ps1 | Hosted PowerShell script used to install SOAX proxyware. |
| URL | hxxp[:]//pub-43fc211373d547278dd3d5bd0b4d9dac[.]r2[.]dev/87648736456384[.]Ps1 | Hosted PowerShell script used to install DigitalPulse proxyware. |
| URL | hxxps[:]//7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e | C&C reporting endpoint listed in the article's IOC section. |
| URL | hxxps[:]//d36rb13t9es4g1[.]cloudfront[.]net/192837455732[.]ps1 | PowerShell resource listed as a threat indicator for the proxyware distribution. |
| URL | hxxps[:]//d3mz24vhl6xvgp[.]cloudfront[.]net/CopilotService[.]exe | Executable payload resource listed as a threat indicator for the proxyware distribution. |
| URL | hxxps[:]//d3mz24vhl6xvgp[.]cloudfront[.]net/liblivenet_amd64[.]dll | SOAX SDK DLL resource listed as a threat indicator for the proxyware distribution. |
| URL | hxxps[:]//d6nue5fz4t6y8[.]cloudfront[.]net/9083743654554665[.]ps1 | Appsalt installation script resource listed in the article's IOC section. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDPLoader's JavaScript is obfuscated; earlier DigitalPulse distribution also used obfuscation to evade detection.T1053.005 · Scheduled TaskTask Scheduler maintains DPLoader execution and registers tasks for the reported proxyware installations.T1055 · Process InjectionEarlier DigitalPulse distribution injected into the Explorer process to bypass detection.T1059.001 · PowerShellDPLoader executes C&C-supplied PowerShell commands that download and run proxyware installation scripts.T1059.003 · Windows Command ShellAn observed DigitalPulse installation command invokes Cmd.Exe to launch PowerShell.T1059.006 · PythonThe initial malware distribution used a Python command to install Node.Js.T1059.007 · JavaScriptThe JavaScript version of DPLoader runs through Node.Js and was used to install DigitalPulse proxyware.T1082 · System Information DiscoveryDPLoader collects basic system information and periodically sends it to its C&C server.T1105 · Ingress Tool TransferPowerShell commands retrieve installation scripts that download proxyware onto infected systems.T1496 · Resource HijackingUnauthorized proxyware installations monetize infected systems' internet bandwidth for the threat actor.T1562.001 · Disable or Modify ToolsThe DigitalPulse installation script executes commands to disable Microsoft Defender.
Threat Actors
Malware
Vendors
AhnLabThe AhnLab SEcurity intelligence Center (ASEC) has been monitoring proxyjacking attacks and confirmed that, in the second half of 2026, the Larva-25012 threat actor has resumed actively distributing Proxyware.IPRoyalLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)SOAXLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
Products
AppsaltLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)DigitalPulseLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)HoneygainThe Proxyware distributed by the threat actors included DigitalPulse, Honeygain, and Infatica; DigitalPulse also employed techniques such as obfuscation or injection into the Explorer process to bypass detection.InfaticaThe Proxyware distributed by the threat actors included DigitalPulse, Honeygain, and Infatica; DigitalPulse also employed techniques such as obfuscation or injection into the Explorer process to bypass detection.IPRoyalLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)Microsoft DefenderThe PowerShell script registers the downloaded Proxyware as a task named “PlutonAgentScheduler” and also performs command execution to disable Microsoft Defender.Node.jsThe initial malware distribution installed Node.Js through a Python command and registered it in the Task Scheduler to ensure that the obfuscated JavaScript—i.E., DPLoader—ran continuously.SOAXLarva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)V3Additionally, for infected systems, users should install a V3 product to prevent further Malware infections.