AvisLoader Windows Malware Uses Peer to Peer Network to Resist Disruption

Security researchers from Varonis discovered a new Windows malware loader named AvisLoader that uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt, according to BleepingComputer. GBHackers News reported that malware delivered through WhatsApp injects into the Windows Task Scheduler to run with SYSTEM privileges. [1][2]

BleepingComputer reported that Varonis Threat Labs discovered AvisLoader on an exposed staging server alongside supporting tools, remote command execution capabilities, and a ClickFix lure. The loader, named after the Latin word for bird, uses shortcut-based persistence and encrypted peer-to-peer networks to maintain connection with its operators. [2]

Malware is software intentionally designed to disrupt computer networks, leak private information, gain unauthorized access, or deprive users of system access without their knowledge. In Windows environments, the Task Scheduler is a component that launches programs or scripts at pre-defined times or intervals. [3][4]

Varonis researchers warned that the combination of ClickFix delivery methods and resilient peer-to-peer infrastructure allows the AvisLoader software to resist conventional infrastructure disruption attempts, BleepingComputer reported. [2]