InfoSecBulletin Cybersecurity for mankind
The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the Qilin ransomware group. They exploited the NETXLOADER malware loader and SmokeLoader, causing 45 confirmed data breaches in a matter of weeks, surpassing major rivals like Akira, Play, and Lynx.
What Is NETXLOADER?
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
NETXLOADER is a new .NET-based malware loader that discreetly delivers second-stage payloads such as Agenda ransomware and SmokeLoader. Trend Micro reports that it uses .NET Reactor 6 for heavy obfuscation and incorporates advanced evasion techniques.
Just-In-Time (JIT) hooking
Control flow obfuscation
Meaningless method names
These features make NETXLOADER very difficult to find and understand, even for experienced reverse engineers.
The Qilin Ransomware Threat:
Qilin, also known as Agenda, has been active since mid-2022 and has evolved over time. Its recent success is partly due to increased affiliate support following the shutdown of RansomHub, a major ransomware group.
According to Group-IB, leak site activity related to Qilin more than doubled since February 2025:
February: 48 disclosures
March: 44 disclosures
April: 45+ disclosures in the first few weeks
Attack Vectors and Targeted Sectors
Initial access is typically achieved using:
Compromised credentials
Spear-phishing campaigns
Once inside the network, NETXLOADER downloads malware that installs Agenda ransomware using a specific method.
Targeted sectors include:
Healthcare
Financial services
Technology
Telecommunications
Countries most impacted so far are the U.S., Netherlands, Brazil, India, and the Philippines.
A Call for Vigilance:
This surge underscores the need for robust cybersecurity hygiene, including:
Regular vulnerability assessments
Endpoint detection and response (EDR) solutions
Advanced email security
User training against phishing
