Threat Actors Leveraging Matanbuchus Malicious Downloader to Ransomware and Establish Persistence

Matanbuchus represents a significant threat in the cybercriminal landscape as a dangerous malware downloader written in C++.

Since 2020, this tool has been sold as Malware-as-a-Service, allowing threat actors to rent access and deploy it against targeted organizations.

In July 2025, security researchers discovered version 3.0 operating in real-world attacks, marking a notable evolution in the malware’s capabilities and sophistication.

The updated variant includes new features designed to evade detection and establish stronger control over compromised systems.

The malware operates by downloading additional payloads directly onto infected machines and enabling attackers to execute commands remotely.

What makes Matanbuchus particularly dangerous is its simplicity combined with effectiveness. Threat actors can quickly chain this downloader with ransomware deployments, making rapid encryption attacks possible.

Recent campaigns demonstrate a clear shift in how cybercriminals are weaponizing this tool, moving beyond simple data theft to coordinated ransomware operations that could paralyze business operations.

Zscaler security analysts identified the malware as part of several coordinated campaigns distributing secondary payloads including the Rhadamanthys information stealer and NetSupport RAT.

The researchers noted that attackers typically establish initial access through QuickAssist, a legitimate Windows remote assistance tool, combined with social engineering to trick users into installation.

Understanding how Matanbuchus gains a foothold is essential for detecting these early stages of compromise.

Infection Process

The infection process typically begins when threat actors use QuickAssist to obtain system access, then execute a command-line download of a malicious Microsoft Installer package.

This MSI file contains an executable named HRUpdate.exe that sideloads a malicious DLL serving as the Matanbuchus downloader module.

The downloader subsequently retrieves the main module from attacker-controlled servers. This multistage approach allows criminals to avoid detection by security tools during initial distribution.

Understanding Persistence Through Encrypted Communications represents a critical aspect of Matanbuchus’s design.

The malware employs advanced obfuscation techniques including the ChaCha20 stream cipher for encrypting strings at runtime and the MurmurHash algorithm for dynamically resolving Windows API functions.

Version 3.0 introduces Protocol Buffers for serializing network communication data, enabling more sophisticated command and control interactions.

The downloader additionally implements long-running loops that deliberately delay execution for several minutes, allowing it to evade behavior-based sandbox detection systems.

Establishing persistence involves downloaded shellcode that creates scheduled tasks, ensuring the malware survives system restarts.

These technical measures work together to create a resilient infection that maintains access while avoiding conventional security detection mechanisms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.