Encrypted Peer‑to‑Peer Channels Power New Windows Loader “AvisLoader”

Security researchers have identified a novel Windows malware loader, dubbed AvisLoader, that leverages encrypted peer‑to‑peer (P2P) traffic to shield its command‑and‑control (C2) network from takedown attempts. The tool, first uncovered by Varonis, appears designed to stay operational even when defenders disrupt traditional server‑based infrastructures.

According to the analysis, AvisLoader is typically delivered via a malicious component named ClickFix, which is bundled with compromised installers or disguised as legitimate software updates. Once executed, the loader establishes persistence through a Windows shortcut (LNK) placed in a startup folder, ensuring it runs each time the system boots. This method, while simple, evades many baseline detection rules that focus on registry or service modifications.

After gaining a foothold, AvisLoader initiates encrypted P2P communications with other infected hosts. By routing commands through a distributed mesh rather than a single C2 server, the malware can issue remote instructions, download additional payloads, or exfiltrate data while making network‑level blocking considerably more difficult. The encryption layer further obscures traffic patterns, limiting the effectiveness of signature‑based intrusion detection systems.

The researchers note that the loader’s remote command execution capability is modular. Operators can push a variety of secondary malware, ranging from credential stealers to ransomware droppers, depending on the target’s profile. This flexibility aligns with trends seen in other “loader” families that act as a delivery platform rather than a standalone threat.

Experts warn that the combination of shortcut‑based persistence, encrypted P2P networking, and a modular architecture makes AvisLoader a particularly resilient threat. Organizations are advised to monitor for anomalous shortcut files in startup locations, enforce strict application whitelisting, and employ behavioral analytics that can flag unusual peer‑to‑peer traffic on corporate networks. As defenders adapt, the emergence of AvisLoader underscores the ongoing arms race between malware authors and security teams, highlighting the need for continuous threat‑intelligence updates and layered defense strategies.