LambLoad
Aliases: OfficeCertTea
- Malware type
- downloader
- Family
- Malware family
- Profile updated
- 2026-07-07 14:29:45
Targeted industries: technology-and-telecommunications
Context
According to Microsoft, this is a downloader used in a supply chain attack involving a malicious variant of an application developed by CyberLink. It is centered around a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload. The file, which was signed using a valid certificate issued to CyberLink Corp., is hosted on legitimate update infrastructure owned by CyberLink and includes checks to limit the time window for execution and evade detection by security products.
Detection coverage
- 2 YARA rules
Detection rules
- SEKOIA_Apt_Lazarus_Lambload_Timecheck (yara-rule)
- MALPEDIA_Win_Lambload_Auto (yara-rule)
Reports & references
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- Kaspersky — 109490 (report)
- ESET — Amazon Themed Campaigns Lazarus Netherlands Belgium (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Lambload (report)
- Microsoft — Diamond Sleet Supply Chain Compromise Distributes A Modified Cyberlink Installer (report)