[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmTBnjzdT-xMkTuxhFRoEo6DhaNn4d2VP4omhUdX0qVQ":3},{"article":4,"iocs":44,"watch_terms":47,"solutions":48,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"0daf8c10-2122-474f-98c5-20f6b95283e1","Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption","inside-avisloader-a-windows-malware-loader-built-to-resist-disruption-a1a981","A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...]","A new Windows malware loader named AvisLoader has been discovered, designed to resist disruption through encrypted peer-to-peer (P2P) communication using the Tox network for its command-and-control (C2) infrastructure. This P2P approach makes traditional domain-based takedowns more difficult. The malware is delivered via a ClickFix lure hosted on Cloudflare Workers, masquerading as a document-signing request, and employs shortcut-based persistence and remote command execution capabilities.","New Windows malware loader AvisLoader uses encrypted P2P Tox communication for C2.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Finside-avisloader-a-windows-malware-loader-built-to-resist-disruption\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F10\u002F08\u002Favisloader.jpg","2026-10-12T14:00:10+00:00","2026-10-12T16:00:15.062508+00:00",8,[17,20,23],{"name":18,"type":19},"AvisLoader","product",{"name":21,"type":22},"Varonis","vendor",{"name":24,"type":25},"Tox","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":30,"value":18,"context":46},"Name of the discovered Windows malware loader.",[21,18],{"controls":49,"vendors":132},[50,79,105],{"slug":51,"name":52,"problem":53,"products":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":80,"name":81,"problem":82,"products":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[84,89,97],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":85,"product_name":86,"url":87,"description":88},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":106,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":149},"avisloader-uses-p2p-c2-and-social-engineering-to-evade-takedowns","AvisLoader Uses P2P C2 and Social Engineering to Evade Takedowns","AvisLoader demonstrates how modern malware combines social engineering (a fake document-signing ClickFix lure) with resilient infrastructure (Tox-based encrypted P2P C2) to bypass traditional defenses. Because the command-and-control channel relies on a decentralized P2P network rather than domains, law enforcement and defenders cannot neutralize the threat through standard domain seizure or sinkholing. The shortcut-based persistence mechanism ensures the malware survives reboots, compounding the damage if initial infection goes undetected. This matters because each layer — deceptive delivery, resilient C2, and persistent execution — is specifically engineered to outlast conventional incident response playbooks.",[138,139,140,141,142,143,144,145,146,147,148],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1566: Phishing (Initial Access)","MITRE ATT&CK T1547: Boot or Logon Autostart Execution","MITRE ATT&CK T1090.003: Proxy — Multi-hop Proxy (P2P C2)",{}]