New 'SynkLoader' Malware Could Be the Opening Move in Future Ransomware Attacks
Researchers at security firm Expel found a sophisticated new malicious program that tricks employees, frustrates security tools, and appears built to prepare corporate networks for ransomware.
Key points
- Expel researchers discovered SynkLoader on a client's network on 18 August, with code evidence suggesting it was first deployed on 28 July.
- The malware began with a phishing email sent from a real Microsoft 365 account, making it look like a message from the victim's own IT department.
- SynkLoader includes a fake Windows lock screen that steals employees' passwords when they type them in.
- Researchers believe the tool was likely built by a ransomware group or a criminal broker who sells network access to ransomware gangs.
- No attribution to a named group has been confirmed; the creators' identity remains unknown at medium-to-low confidence.
A newly discovered malicious program called SynkLoader is raising concerns among security researchers because of how carefully it was built to slip past corporate defences. The name, coined by Marcus Hutchins and his colleagues at security firm Expel who found it, comes from the phrase "everything but the kitchen sink", a nod to how many tricks the program throws at its targets.
How did the attack start?
The criminals behind SynkLoader did not use cheap, obvious tricks. They set up a genuine Microsoft 365 account and sent a phishing email, a fake message designed to trick the recipient, that looked like it came from the victim's own IT Service Desk. The malicious installer they linked to was even hosted on an official Microsoft Azure storage page, making it look legitimate at a glance.
The email asked the employee to install what it called a PowerShell system maintenance tool. PowerShell is a built-in Windows program that runs commands on a computer. The "tool" was anything but maintenance software.
What does SynkLoader actually do?
Once installed, the program deploys several components working together. At its core, instructions run entirely in temporary memory rather than being written to the hard drive, which makes the malware harder for security software to spot.
It also drops a stripped-down Python programming environment into a random folder. Python is not commonly used in malware, which helps the program avoid triggering security alerts. Hutchins notes that a Python installation sitting in an unusual folder location is itself a red flag worth watching for.
A collection of supporting files called DLLs (dynamic link libraries, which are small programs Windows apps call on to do specific jobs) extends what Python cannot do on its own. One DLL profiles the victim's entire network: how many computers belong to it, what services are running, and what level of access the local user has.
"To measure the size of the victim's network is typically something only of interest to ransom groups," Hutchins told Dark Reading. Espionage-focused state-sponsored groups generally already know their target's scale before they move. Opportunistic ransomware gangs, by contrast, need to size up a network before they can price a ransom demand.
Other modules give the criminals live access to the victim's screen and keyboard, create a recurring background task to keep the infection alive between restarts, and route the attackers' internet traffic through the victim's own network connection.
The fake lock screen stealing passwords
The most striking component is one the researchers called "PhishLocker." It presents the victim with what looks exactly like a standard Windows login screen, blocking use of the computer until they type in their password.
The screen is a fake. But the password the victim types is real, and it goes straight to the attackers.
This matters more now than it would have a decade ago. Many companies use single sign-on systems, meaning the same password that unlocks a laptop also unlocks email, HR software, and financial tools. One captured password can open a great deal of a company's internal world.
| Component | What it does |
|---|---|
| PowerShell script | Runs instructions in temporary memory to avoid detection |
| Python environment | Hosts the malware's core in an unusual location |
| System profiler DLL | Maps the victim network's size and user privileges |
| Persistence module | Creates a hidden recurring task to survive reboots |
| Remote access module | Streams the victim's screen; enables keyboard and mouse control |
| PhishLocker DLL | Shows a fake Windows lock screen to steal the user's password |
Should employees be worried?
If you received an unexpected email from your "IT department" asking you to install a tool, pause before clicking anything. Legitimate IT teams rarely ask employees to install software by following a link in an email. When in doubt, call your IT desk directly using a number you already know.
No confirmed ransomware attacks have been linked to SynkLoader yet. The program appears to be in early deployment, and its creators have not been publicly identified. Researchers at Expel have not publicly overlapped its infrastructure with any currently tracked APT cluster (an advanced persistent threat, meaning a hacking group that runs long-term, targeted campaigns) or known ransomware affiliate. Attribution remains open.
Common questions
Am I at personal risk from SynkLoader?
For now, this malware appears aimed at corporate networks rather than home users. The most practical thing anyone can do at work is treat unexpected emails asking for software installs with scepticism, even if the sender looks familiar.
How would a company know if it was infected?
Hutchins points to one concrete signal: a Python installation sitting in an unexpected folder inside the Windows AppData directory. Security teams can search for out-of-place Python executables as a starting point.
