The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the Qilin ransomware group. They exploited the NETXLOADER malware loader and SmokeLoader, causing 45 confirmed data breaches in a matter of weeks, surpassing major rivals like Akira, Play, and Lynx.
What Is NETXLOADER?
By infosecbulletin
/ Wednesday , June 18 2025
Russian cybersecurity experts discovered the first local data theft attacks using a modified version of legitimate near field communication (NFC)...
Read More
By infosecbulletin
/ Tuesday , June 17 2025
Cybersecurity researcher Jeremiah Fowler discovered an unsecured database with 170,360 records belonging to a real estate company. It contained personal...
Read More
By infosecbulletin
/ Tuesday , June 17 2025
GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel's IKE affecting UDP port 500. The attack centers around CVE-2023-28771,...
Read More
By infosecbulletin
/ Tuesday , June 17 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV)...
Read More
By infosecbulletin
/ Monday , June 16 2025
SafetyDetectives’ Cybersecurity Team discovered a public post on a clear web forum in which a threat actor claimed to have...
Read More
By infosecbulletin
/ Sunday , June 15 2025
WestJet, Canada's second-largest airline, is looking into a cyberattack that has affected some internal systems during its response to the...
Read More
By infosecbulletin
/ Saturday , June 14 2025
Resecurity found 7.4 million records of Paraguayan citizens' personal information leaked on the dark web today. Last week, cybercriminals attempted...
Read More
By infosecbulletin
/ Friday , June 13 2025
HashiCorp has revealed a critical vulnerability in its Nomad tool that may let attackers gain higher privileges by misusing the...
Read More
By infosecbulletin
/ Friday , June 13 2025
SoftBank has disclosed that personal information of more than 137,000 mobile subscribers—covering names, addresses, and phone numbers—might have been leaked...
Read More
By infosecbulletin
/ Friday , June 13 2025
Serious security vulnerabilities in Trend Micro Apex One could allow attackers to inject malicious code and elevate their privileges within...
Read More
NETXLOADER is a new .NET-based malware loader that discreetly delivers second-stage payloads such as Agenda ransomware and SmokeLoader. Trend Micro reports that it uses .NET Reactor 6 for heavy obfuscation and incorporates advanced evasion techniques.
Just-In-Time (JIT) hooking
Control flow obfuscation
Meaningless method names
These features make NETXLOADER very difficult to find and understand, even for experienced reverse engineers.
The Qilin Ransomware Threat:
Qilin, also known as Agenda, has been active since mid-2022 and has evolved over time. Its recent success is partly due to increased affiliate support following the shutdown of RansomHub, a major ransomware group.
According to Group-IB, leak site activity related to Qilin more than doubled since February 2025:
February: 48 disclosures
March: 44 disclosures
April: 45+ disclosures in the first few weeks
Attack Vectors and Targeted Sectors
Initial access is typically achieved using:
Compromised credentials
Spear-phishing campaigns
Once inside the network, NETXLOADER downloads malware that installs Agenda ransomware using a specific method.
Targeted sectors include:
Healthcare
Financial services
Technology
Telecommunications
Countries most impacted so far are the U.S., Netherlands, Brazil, India, and the Philippines.
A Call for Vigilance:
This surge underscores the need for robust cybersecurity hygiene, including:
Regular vulnerability assessments
Endpoint detection and response (EDR) solutions
Advanced email security
User training against phishing