SynkLoader: The Malware That Steals Passwords and Prepares the Ground for Ransomware

New Multi-Tool for Initial Access Discovered

Researchers at Expel, led by Marcus Hutchins, have identified and named a new sophisticated malware family: SynkLoader. The name comes from the English phrase “everything but the kitchen sink” – corrupted into “Synk”. The choice is not coincidental: the program integrates a wide range of tactics and modules designed to infiltrate corporate systems, from credential theft to remote desktop control.

The ultimate purpose remains unknown, but several elements in the code suggest it is the work of a ransomware group or an initial access broker (IAB), i.e., an actor that sells initial access to compromised networks. Compilation metadata indicate a likely first use on July 28; the first documented observation in a customer network occurred on August 18.

The Deception Starts from a Legitimate Microsoft 365 Tenant

The initial incident analyzed by Expel began with a particularly insidious phishing email. Instead of resorting to domains similar to corporate ones (typosquatting), the attackers registered their own Microsoft 365 tenant and contacted the victim using an address on the default onmicrosoft.com domain, posing as the corporate IT Service Desk.

They requested the installation of a fake PowerShell maintenance tool. The installer was hosted on an official Microsoft Azure storage page, leveraging the Microsoft brand to increase credibility. This approach makes it much harder for users and filters to distinguish malicious communication from a legitimate request.

A Modular Arsenal: Python, DLL and COM to Evade EDR

The SynkLoader installer distributes several components: a PowerShell script that executes instructions in temporary memory, a minimal Python environment, a malicious Python script that communicates with command and control (C2) domains, and several fake Microsoft runtime DLLs.

The use of Python is strategic. Historically, malware written entirely in Python is not very widespread, so some signals from EDR (Endpoint Detection and Response) tools are reduced. Since Python is not a native Windows language, the malware carries native C/DLL components that enable behaviors impossible to achieve directly in Python, creating a bridge to execute malicious actions within a Python process.

The DLL modules include:

• System profiler: collects running processes and services, local user privileges, the Active Directory (AD) domain name, and the number of other computers belonging to the AD network. Hutchins emphasizes that measuring the size of the victim network is typical of opportunistic ransomware groups, while an APT (Advanced Persistent Threat) already knows the targeted organization.
• Persistence: creates a recurring Windows scheduled task. Instead of invoking the Task Scheduler from the command line, it interacts directly with the Windows COM interface, almost certainly to avoid EDR flags.
• RAT (Remote Access Trojan): acts as a remote access trojan.
• Desktop control: transmits the victim's desktop and allows control of mouse and keyboard.
• Reverse proxy: exploits the victim computer's IP address to route Internet traffic and reach internal services otherwise accessible only from the organization's LAN.
• PhishLocker: the most unexpected component, described below.

PhishLocker, the Fake Screen Lock That Extorts the Windows Password

In the past, lockers used JavaScript to force the browser into full screen and prevented exit without credentials or payment: one of the earliest forms of ransomware. They were also used for phishing, for example simulating an Outlook client in HTML to steal application passwords. Organizations had eliminated the browser functionality that allowed it.

SynkLoader brings back screen locking via a DLL. The DLL contains an elaborate GUI that mimics the Windows lock screen, almost indistinguishable from the original. PhishLocker prevents the victim from exiting until they provide the Windows account password. Currently, the malware does not have a check on the correctness of the entered password.

According to Hutchins, it is an effective way to obtain the system password, especially in networks based on SSO (Single Sign-On) where the computer login password coincides with that of corporate services. This gives attackers powerful credentials for lateral movement.

Clues of a Ransomware Group or an Access Broker

No formal severity score is provided, but the combination of capabilities – in-memory execution, persistence via COM, RAT, desktop control, reverse proxy, and Windows password theft – indicates a high risk.

The purpose is not confirmed, but the code and network profiler suggest that SynkLoader may be the work of a ransomware group or an initial access broker (IAB) used to prepare a subsequent ransomware attack. The potential impact includes compromise of corporate credentials in SSO environments, lateral movement, access to internal services, and disruption through screen locking.

What Defenders Can Do: Indicators and Controls

Full mitigations have not yet been disclosed, but Expel reports some useful indicators. The main one is the presence of a Python executable out of place in non-standard paths or in AppData. Since persistence uses COM instead of command-line Task Scheduler, monitoring scheduled tasks created via COM can help identify anomalous behavior.

From the initial vector perspective, the email impersonating the IT Service Desk from an onmicrosoft.com domain and the installer hosted on Azure storage can feed email and web controls: verify sender legitimacy, block or flag suspicious requests to install tools, and check downloads from non-corporate cloud storage domains.

The discovery of SynkLoader adds a piece to the growing sophistication of attacks preceding ransomware: modular tools, abuse of legitimate cloud services, and increasingly targeted evasion techniques. For defenders, observing weak signals – a Python process in an unusual folder, a scheduled task created via COM – can make the difference before access is converted into a concrete attack.