Blister
Aliases: COLORFAKE
- Malware type
- loader
- Family
- Malware family
- Last IoC activity
- 2026-07-21 08:37:18
- Profile updated
- 2026-07-07 13:02:58
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Context
Elastic observed this loader coming with valid code signatures, being used to deploy secondary payloads in-memory.
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Blister (yara-rule)
- CAPE_Blister_1 (yara-rule)
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- killingthebear.jorgetesta.tech — Evil Corp (report)
- Mandiant — Unc2165 Shifts To Evade Sanctions (report)
- twitter.com — 1522690116979855360 (report)
- Trend Micro — Iocs Thwarting Loaders Socgholish Blister.Txt (report)
- Trend Micro — Thwarting Loaders From Socgholish To Blisters Lockbit Payload (report)
- Trend Micro — Thwarting Loaders From Socgholish To Blisters Lockbit Payload (report)
- medium.com — Socgholish Campaigns And Initial Access Kit 4C4283Fea8Ee (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Blister (report)
- elastic.github.io — Article (report)
- security-labs.elastic.co — Revisiting Blister New Developments Of The Blister Loader (report)
- cloudsek.com — Technical Analysis Of Code Signed Blister Malware Campaign Part 1 (report)
- elastic.co — Elastic Security Uncovers Blister Malware Campaign (report)
- redcanary.com — Intelligence Insights January 2022 (report)
- elastic.co — Revisiting Blister New Developments Of The Blister Loader (report)
- blog.fox-it.com — Popping Blisters For Research An Overview Of Past Payloads And Exploring Recent Developments (report)
- cloudsek.com — Technical Analysis Of Code Signed Blister Malware Campaign Part 2 (report)