Oyster
Oyster, most commonly referred to as OysterLoader and also known as Broomstick, CleanUp, and CleanUpLoader, is a C++ multi-stage loader/backdoor. Reporting describes it as a modular implant used to establish persistent remote access, initiate command-and-control communications, collect host-level information, and deliver additional payloads. It is closely linked to campaigns associated with the Rhysida ransomware group and has also been used to distribute other malware including Vidar.
Observed delivery vectors include trojanized or deceptive installers masquerading as legitimate software such as Microsoft Teams, Google Chrome, PuTTY, WinSCP, Google Authenticator, and other popular tools, often distributed via malvertising, fake download pages, search manipulation, SEO poisoning, and compromised WordPress sites. In one documented chain, a fake Microsoft Teams installer executed a signed binary that deployed Oyster and in some cases led to Rhysida ransomware deployment. Microsoft also described signed fake Teams installers delivering Oyster through the Fox Tempest malware-signing-as-a-service ecosystem.
Capabilities directly described in the reporting include persistence, command-and-control, host reconnaissance, host data exfiltration, and remote code execution. Microsoft’s Trojan:Win64/Oysterloader.AO!MTB reporting states that a deceptive downloader extracts a legitimate installer and a malicious DLL to the Temp directory, launches the legitimate installer as a decoy, and executes the DLL via rundll32.exe with the argument "Test." Persistence has been observed via a scheduled task named ClearMngs running every three hours; other reporting describes scheduled-task execution of a dropped DLL such as COPYING3.dll via rundll32.exe every 13 minutes. OysterLoader performs host enumeration including computer name, username, domain, OS version, local IP address, privilege level, and DLL version, formats the data as JSON, and sends it to C2 infrastructure.
The malware uses a four-stage infection chain in public reporting: a TextShell packer, custom shellcode with bespoke LZMA decompression and relocation handling, an intermediate downloader that performs environment checks, and a final core DLL payload. Reported anti-analysis and evasion features include API hammering, anti-debugging with IsDebuggerPresent, dynamic API resolution using custom hashing, modified LZMA routines, obfuscated embedded C2 domains, custom encoding, spoofed headers, deceptive user-agent strings, and use of signed MSI installers or signed binaries to appear legitimate.
Reported network behavior includes earlier use of /reg and /login endpoints over HTTPS, with fake User-Agent strings such as WordPressAgent and FingerPrint, and later evolution to /api/v2/init, /api/v2/facade, and dynamically assigned beacon endpoints. Microsoft also reported HTTP POST communications to api/connect and api/session. Publicly reported C2-related indicators include domains supfoundrysettlers[.]us, whereverhomebe[.]com, and retdirectyourman[.]eu, and IPs 85.239.53[.]66, 51.222.96[.]108, and 135.125.241[.]45. Additional artifacts directly mentioned include MSTeamsSetup_c_l_.exe, CleanUp30.dll, COPYING3.dll, the ClearMngs scheduled task, and mutexes ITrkfSaV-4c7KwdfnC-Ds165XU4C-lH6R9pk1 and h6p#dx!&fse?%AS!.
Oyster has repeatedly been associated with Fox Tempest’s code-signing abuse operation, which Microsoft said was used by threat actors including Vanilla Tempest and others to sign and distribute malware such as Oyster, Lumma Stealer, and Vidar, helping the binaries bypass Windows and other security controls. Downstream activity tied to this ecosystem has affected sectors including healthcare, education, government, and financial services globally.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The lawsuit targets Fox Tempest’s infrastructure and also names Vanilla Tempest as a co-conspirator, a prominent ransomware group that used the service to deploy malware like Oyster, Lumma Stealer, and Vidar, and ransomware, including Rhysida, in multiple recent cyberattacks.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
The service had been used to sign and distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, making malicious software appear legitimate and easier to deliver at scale.
Fox Tempest’s operation — which included an authenticated portal and a drag-and-drop feature for rapid code signing — was directly linked to dozens of malware families, including Oyster, Lumma Stealer, MuddyWater, and Vidar.
There’s an ongoing malicious ad campaign delivering a malware called OysterLoader, previously known as Broomstick and CleanUpLoader. The malware is an initial access tool (IAT) that gets onto devices to run a backdoor to gain access to the device and network.
OysterLoader, also known as Broomstick and CleanUp, is a malware developed in C++, composed of multiple stages, belonging to the loader (A.k.a.: downloader) malware family.
OysterLoader, also known as Broomstick and CleanUp, is a malware developed in C++, composed of multiple stages, belonging to the loader (A.k.a.: downloader) malware family.
X-Force links the group to malware developers/operators such as Broomstick, Supper, PortStarter, SystemBC, and Rhysida ransomware...
Confirmed TA582 payloads sharing this infrastructure: GhostWeaver/Pantera, MintsLoader, trojanized BOINC, CleanUpLoader, and StealC (per Recorded Future).
Confirmed TA582 payloads sharing this infrastructure: GhostWeaver/Pantera, MintsLoader, trojanized BOINC, CleanUpLoader, and StealC (per Recorded Future).
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 techniqueRansomware operators and other threat groups primarily deployed these fraudulent certificates in ads or SEO poisoning, which brought their malicious software and infostealers to the top of search rankings, ensnaring unsuspecting victims who thought they were downloading and running legitimate applications.
Resource Development
4 techniquesAttackers then distributed the signed malware through tactics such as search manipulation and malicious ads, where users are more likely to trust what they encounter.
MITRE ATT&CK: Resource Development & Execution Technique ID Application Compromise Infrastructure: Web Services T1584.006 Compromised WordPress site for payload hosting
Further analysis revealed that Fox Tempest expanded its offerings earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure. Users could upload malware to these systems and receive digitally signed binaries generated through certificates controlled by the group.
Attackers then distributed the signed malware through tactics such as search manipulation and malicious ads, where users are more likely to trust what they encounter.
Initial Access
2 techniquesIntrusions involved luring targets to download a setup binary from legitimate-looking fraudulent websites that directly deploys the Oyster malware...
MITRE ATT&CK: Initial Access Technique ID Application Phishing: Spearphishing Link T1566.002 Email with link to malware delivery site
Execution
3 techniques...attacks also entailed the installation of legitimate Microsoft Teams software and a PowerShell script to evade detection and ensure persistence...
When unsuspecting victims executed the falsely named Microsoft Teams installer files, those files delivered a malicious loader, which in turn installed the fraudulently signed Oyster malware and ultimately deployed Rhysida ransomware.
Victims were presented with a malicious MSTeamsSetup.exe in place of the legitimate client... Execution of the counterfeit installer resulted in the deployment of the Oyster backdoor.
Stealth
3 techniquesA multi-stage malware loader known as OysterLoader has continued to evolve into early 2026, refining its command-and-control (C2) infrastructure and obfuscation methods.
Dynamic API resolution is handled through custom hashing algorithms that vary slightly between samples.
The signed files often impersonated trusted software brands such as Microsoft Teams, AnyDesk, PuTTY, and Webex, making them appear more credible to potential victims.
Defense Impairment
2 techniquesThe operation enabled cybercriminals to sign malicious software with fake trusted certificates, making it appear legitimate and easier to distribute.
Microsoft has announced the disruption of a large-scale malware-signing-as-a-service (MSaaS) operation that exploited its Azure Artifact Signing platform to generate fraudulent code-signing certificates... The group allegedly abused Microsoft's Artifact Signing service to create short-lived digital certificates that allowed malware to appear legitimate to both users and operating systems.
Discovery
1 techniqueExecution of the counterfeit installer resulted in the deployment of the Oyster backdoor ... collects host-level information
Command and Control
2 techniquesC2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.
Researchers found that the malware-signing operation enabled customers to upload malicious files and receive code-signed versions using fraudulently acquired certificates.
IOCs tracked for this family
104 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Oyster was distributed as fraudulently signed malware through the abused Azure Artifact Signing service. In the described campaign, a fake Microsoft Teams installer delivered a malicious loader that installed Oyster, which ultimately led to deployment of Rhysida ransomware.
Загрузчик малвари, который подписывался через злоупотребление Artifact Signing, маскировался под легитимное ПО и использовался для обхода защитных механизмов Windows и последующего разворачивания вымогателя.
A modular implant and loader distributed via signed binaries and bogus Microsoft Teams download pages; it is used to deliver Rhysida ransomware.
Malware family whose files were signed using fraudulent trusted certificates through Fox Tempest to improve delivery and bypass security controls.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.