HUI Loader

MITRE ATT&CK: S1097 View on attack.mitre.org

Aliases: SIDESTEP, HUI Loader

First seen
2015-01-01 00:00:00
Malware type
loader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:03:17

Targeted industries: government-and-public-sector technology-and-telecommunications energy-and-utilities

Targeted regions: country_code:cn country_code:us country_code:jp

Context

HUI Loader is a custom DLL loader that has been used since at least 2015 by China-based threat groups including Cinnamon Tempest and menuPass to deploy malware on compromised hosts. HUI Loader has been observed in campaigns loading SodaMaster, PlugX, Cobalt Strike, Komplex, and several strains of ransomware.

Detection coverage

  • 1 YARA rules
  • 249 Sigma rules

Malware & tools used

  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • DLL (attack-pattern)

Used by threat actors

Detection rules

  • SEKOIA_Apt_Apt10_Hui_Loader (yara-rule)

Reports & references

  • sentinelone.com — Chinese Entanglement Dll Hijacking In The Asian Gambling Sector (report)
  • secureworks.com — Bronze Starlight Ransomware Operations Use Hui Loader (report)
  • MITRE ATT&CK — G1021 (report)
  • virusbulletin.com — Down The Grayrabbit Hole Exposing Unc3569 And Its Modus Operandi (report)
  • jsac.jpcert.or.jp — Jsac2022 9 Yanagishita Tamada Nakatsuru Ishimaru En (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Hui Loader (report)
  • medium.com — Hui Loader Malware Analysis Note 4Fa0E1C791D3 (report)
  • blogs.jpcert.or.jp — Huiloader (report)
  • MITRE ATT&CK — S1097 (report)

External references