Emmenhtal
Aliases: IDATDropper, PEAKLIGHT
- First seen
- 2024-01-01 00:00:00
- Malware type
- loader, dropper, rat
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:34:26
- Profile updated
- 2026-07-07 14:55:25
Targeted industries: financial-services technology-and-telecommunications
Context
Emmenhtal is a malicious loader likely distributed since early 2024, and publicly detailed by Orange Cyberdefense CERT in August 2024. Emmenhtal is an obfuscated multistage payload that spawns an execution of the LOLBIN mshta.exe to read a first HTA stage that embeds a malicious JavaScript code. Once interpreted and executed, the JavaScript decodes and runs a PowerShell script. The latter decrypts an obfuscated PowerShell loader which finally downloads and runs final-stage stealers and commodity RATs. As of March 2025, Orange Cyberdefense CERT has identified three versions of the loader, all actively distributed.
Used by threat actors
- Emmenhtal Loader Distribution Activity (campaign)
Reports & references
- cloud.google.com — Peaklight Decoding Stealthy Memory Only Malware (report)
- strikeready.com — Ru Apt Targeting Energy Infrastructure Unknown Unknowns Part 3 (report)
- github.com — Edam (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Emmenhtal (report)
- labs.k7computing.com — Tracking Emmenhtal (report)
- youtube.com — Watch (report)
- x.com — 1900460479778030013 (report)
- group-ib.com — Clickfix The Social Engineering Technique Hackers Use To Manipulate Victims (report)
- kroll.com — Idatloader Distribution (report)
- McAfee — Behind The Captcha A Clever Gateway Of Malware (report)
- x.com — 1870137789402014155 (report)
- youtube.com — Watch (report)
- youtube.com — Watch (report)
- orangecyberdefense.com — Emmenhtal A Little Known Loader Distributing Commodity Infostealers Worldwide (report)