Listen to this Post
In a worrying development for cybersecurity, the long-running Matanbuchus malware, first identified in 2020, has re-emerged with a new, more sophisticated version. Targeting businesses and organizations, Matanbuchus v3.0 demonstrates advanced evasion tactics, encrypted communication methods, and the ability to deliver secondary payloads that could lead to ransomware attacks. Recent analyses from Zscaler ThreatLabz reveal how this malware continues to evolve, leveraging modern obfuscation techniques and advanced persistence strategies that make detection and removal increasingly challenging.
Matanbuchus v3.0: A Detailed Summary
Matanbuchus operates as a Malware-as-a-Service (MaaS) platform, allowing threat actors to deploy its capabilities without deep technical expertise. The latest campaign, observed in July 2025, demonstrates significant technical upgrades. One notable advancement is the use of Google Protocol Buffers (Protobufs) for encrypted command-and-control (C2) communication, which allows the malware to efficiently transmit instructions while bypassing conventional security monitoring.
The infection chain typically begins with social engineering attacks targeting the QuickAssist remote support tool. Once access is obtained, the attacker downloads a malicious MSI file from domains like gpa-cro[.]com. This MSI contains a legitimate-looking executable, HRUpdate.exe, which sideloads the Matanbuchus downloader DLL. The downloader then retrieves the main malware module from hxxps://mechiraz[.]com/cart/checkout/files/update_info.aspx.
Both downloader and main modules use heavy obfuscation. Strings are encrypted using ChaCha20 and only decrypted at runtime, while Windows API functions are dynamically resolved by hash using MurmurHash. Junk code is embedded throughout the modules, complicating reverse engineering efforts. Additionally, long-running loops delay execution to evade sandbox detection, and brute-force methods derive the encryption keys needed to load the main module securely.
Once deployed, Matanbuchus ensures persistence by creating a Windows scheduled task named “Update Tracker Task.” This task executes msiexec.exe with parameters pointing to the malware’s location, while a unique mutex prevents multiple instances on a single host. The malware collects system information, including hostname, OS version, domain, and security software installed, before registering with its C2 server. Commands from the attacker can include downloading and executing payloads, injecting shellcode, running PowerShell or CMD commands, and collecting system inventory.
Recent campaigns have also seen Matanbuchus delivering secondary malware like the Rhadamanthys information stealer and the NetSupport RAT. Zscaler ThreatLabz suggests with medium confidence that these intrusions may precede ransomware attacks. Cloud-based detection systems currently flag Matanbuchus as Win32.Backdoor.Matanbuchus, with active C2 infrastructure still observed at mechiraz[.]com.
What Undercode Say: Advanced Threat Analysis
The resurgence of Matanbuchus highlights a troubling trend in the malware ecosystem: long-standing MaaS platforms are not only surviving but evolving to outpace traditional security defenses. Its use of Protobufs for encrypted C2 communication is particularly concerning. This approach allows malware operators to send structured, encrypted messages that are difficult for network monitoring tools to detect. Combined with ChaCha20 encryption, these communications are highly resilient against interception and analysis.
Matanbuchus’ obfuscation techniques reflect a deep understanding of reverse engineering challenges. Dynamic API resolution, junk code insertion, and long execution loops are all designed to frustrate automated analysis tools and human researchers alike. The use of MSI sideloading is also clever; by hiding malicious code within legitimate files, attackers bypass many endpoint security solutions that rely on signature-based detection.
Persistence mechanisms in Matanbuchus are meticulously designed. By creating a scheduled task and using a mutex tied to the host’s volume serial number, the malware ensures continuous operation while avoiding conflicts between multiple instances. These features, combined with system reconnaissance capabilities, suggest that Matanbuchus is designed for targeted campaigns rather than indiscriminate attacks.
The inclusion of secondary payloads like Rhadamanthys and NetSupport RAT indicates a multi-stage attack strategy. This modularity allows operators to adapt to different environments, from stealing credentials to establishing remote access for future ransomware deployment. Organizations relying solely on traditional antivirus solutions are particularly vulnerable, as Matanbuchus bypasses signature-based detection and leverages real system processes for execution.
Furthermore, the malware’s timeline demonstrates a slow but deliberate evolution. Since its first observation in 2020, Matanbuchus has incrementally upgraded its capabilities to match defensive improvements in the cybersecurity landscape. This suggests that future versions could incorporate even more sophisticated techniques, including AI-driven obfuscation or automated lateral movement within networks.
From a broader perspective, Matanbuchus reflects the ongoing professionalization of cybercrime. Its modular design, MaaS availability, and persistent update cycle mimic legitimate software development practices, making mitigation increasingly difficult. Organizations must therefore adopt layered defense strategies that include behavioral analysis, network traffic inspection, and proactive threat hunting to counter such advanced threats.
Finally, the campaign’s reliance on social engineering underscores the human element in cybersecurity. While technical defenses are essential, user education and awareness remain critical in preventing initial infection. Without addressing this human vulnerability, even the most advanced security tools may struggle to contain sophisticated malware like Matanbuchus.
🔍 Fact Checker Results
✅ Matanbuchus was first observed in 2020 and continues to be active in 2025.
✅ Version 3.0 uses Protobufs for encrypted C2 communication and ChaCha20 for string encryption.
❌ There is no evidence that all Matanbuchus infections directly result in ransomware deployment; secondary payloads vary.
📊 Prediction
Given its history and current capabilities, Matanbuchus is likely to evolve further in the next 12–18 months. We can expect:
Expansion of multi-stage attacks combining information theft and ransomware.
Increased use of AI-assisted obfuscation and dynamic payload generation.
Higher targeting of enterprise environments with critical infrastructure.
Organizations that fail to adopt advanced threat detection and behavioral monitoring may face escalating risks. Vigilance, proactive threat hunting, and user education will become more critical than ever.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.github.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
