Qilin beefs up arsenal with SmokeLoader, NETXLOADER payloads | #ransomware | #cybercrime

Malicious payloads NETXLOADER and SmokeLoader have been leveraged by the Qilin ransomware gang, also known as Agenda, to escalate attacks against telecommunications, healthcare, financial services, and technology organizations in the U.S., Brazil, the Netherlands, India, and the Philippines during the first three months of 2025, reports GBHackers News.

Advanced obfuscation methods, including JIT hooking and control flow obfuscation, and multiple nefarious domains have been harnessed by NETXLOADER to facilitate covert in-memory deployment of Agenda ransomware and SmokeLoader payload, according to a Trend Micro analysis. On the other hand, SmokeLoader employs dynamic API resolution and other sophisticated anti-detection techniques, as well as ensures persistence and escalates privileges. Such findings, which indicate the increasingly refined methods used by the Qilin ransomware operation to maximize their attacks, should prompt organizations to implement not only multi-layered security measures but also robust access controls and prudent threat tracking mechanisms to combat sophisticated malware delivery tactics.