Malware

Broomstick

Also known as: CLEANBOOST · CleanUp · CleanUpLoader · Oyster

Oyster is a backdoor malware written in C++ that first appeared in July 2023. It allows for remote sessions, supporting tasks such as file transfer and command-line processing. This malware has been used by numerous threat actors as a tool to facilitate ransomware intrusions. The distribution of Oyster has likely occurred through various methods, as suggested by the build identifiers found in examined samples. Additionally, Oyster is capable of collecting basic system data and communicates with a command-and-control (C2) server. It can execute commands via cmd.exe and run additional files. In August 2024, a new version of Oyster was discovered that featured a new command-and-control (C2) communication protocol format. This 2024 version contained plaintext strings and lacked code obfuscation, suggesting it was still in development. In contrast to the 2024 version, the new 2025 Oyster version does not send C2 messages in plaintext, instead reintroducing the substitution cipher that was present in earlier versions of Oyster.

Indicators of Compromise 12

SHA-256 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7 SHA-256 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d SHA-256 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14 SHA-256 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd SHA-256 66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd SHA-256 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb SHA-256 bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7 SHA-256 c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c SHA-256 c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef SHA-256 dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac SHA-256 dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966 SHA-256 e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22

MITRE ATT&CK TTPs 24

Obfuscated Files or Information

Defense Evasion

Defense Evasion

Process Injection

Defense Evasion

Command and Scripting Interpreter

Application Layer Protocol

Command And Control

Command And Control

System Information Discovery

File and Directory Discovery

Command And Control

Ingress Tool Transfer

Command And Control

External Remote Services

Exploitation for Client Execution

Exploitation for Credential Access

Credential Access

Group Policy Modification

Defense Evasion

Data Encrypted for Impact

System Firmware

Windows Service

Bypass User Account Control

Privilege Escalation

Credentials In Files

Credential Access

DLL Side-Loading

Resource Development

Source Articles

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Unit42 analyzed 405 AI-enabled malware samples and found that only 12 were observed in production environments, indicating that most such malware remains in proof-of-concept or testing stages. The operational threats included FunkSec ransomware, a trojanized AI application (Recipe Lister), the Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL. These threats used techniques such as code signing abuse, DLL side-loading, and social engineering leveraging AI branding. All were detected and blocked by existing defenses including sandboxing, behavioral analytics, and cloud-based verdicts, with no novel detection methods required.

unit42 ·1w ago

IT threat evolution in Q2 2026. Non-mobile statistics

In Q2 2026, multiple ransomware groups remained active, with Qilin emerging as the most prolific based on victims listed on data leak sites. Microsoft disrupted a malware-signing-as-a-service operation run by the threat actor Fox Tempest, which was used by several ransomware groups including Rhysida, Akira, and Qilin. CISA added a Windows local privilege escalation vulnerability (CVE-2026-33825, BlueHammer) to its KEV catalog due to active exploitation in ransomware attacks. Check Point attributed zero-day exploitation of a critical vulnerability in its Remote Access VPN (CVE-2026-50751) to the Qilin ransomware group. Additionally, the PayoutsKing group was observed using QEMU to deploy hidden Alpine Linux-based virtual machines as a stealthy backdoor technique.

securelist ·3w ago