AvisLoader Malware Loader Uses Encrypted P2P C2 to Evade Domain‑Based Takedowns
What Happened — Varonis Threat Labs uncovered AvisLoader, a new Windows‑based malware loader that is distributed via a “ClickFix” phishing lure mimicking a document‑signing request. Once executed, the loader contacts a command‑and‑control (C2) server that operates over the encrypted Tox peer‑to‑peer network, eliminating reliance on static domains or IP addresses.
Why It Matters for Trust & Control Assurance
- The use of a decentralized, encrypted C2 channel defeats traditional domain‑blocking and highlights the need for continuous monitoring of anomalous network traffic and process behavior.
- Detecting such loaders requires evidence‑driven control mapping that can be tied to multiple compliance frameworks (e.g., NIST CSF Detect function) to demonstrate a defensible audit trail.
- Continuous control‑assurance programs that collect and correlate endpoint logs, network flows, and threat‑intel feeds are the only way to surface hidden P2P communications before they enable payload delivery.
Who Is Affected – Organizations of any size that run Windows workstations and rely on web‑based document‑signing workflows; especially sectors with high‑value data such as finance, healthcare, and SaaS providers.
Recommended Actions –
- Enrich endpoint detection and response (EDR) rules to flag execution of unsigned loaders that inherit the asInvoker manifest and spawn network connections to non‑standard ports.
- Deploy network‑traffic analysis that can identify encrypted Tox traffic patterns or abnormal peer‑to‑peer flows.
- Map these detection controls to the “Detect” and “Respond” functions of your chosen framework to maintain audit‑ready evidence.
Source: Varonis Threat Labs – Inside AvisLoader
Technical Notes –
- Delivery vector: Phishing page (ClickFix) hosted on Cloudflare Workers, prompting users to copy‑paste a command that pulls the loader from a Cloudflare Quick Tunnel address.
- Loader characteristics: 3.4 MB 64‑bit PE, manifest set to asInvoker (no UAC prompt), packed with multiple obfuscation layers (Themida, VMProtect, Enigma, UPX).
- C2 protocol: Encrypted Tox P2P network, enabling operators to move the controller by copying a Tox save file, removing any fixed DNS/IP footprint.