AvisLoader: A New Windows Loader Using P2P C2 to Resist Takedowns

What happened

Researchers at Varonis have documented a new Windows malware loader dubbed AvisLoader. According to their analysis, the loader stands out for using encrypted peer-to-peer (P2P) command-and-control communications, which makes its C2 infrastructure more resilient to disruption than traditional single-server setups. Varonis describes AvisLoader as being delivered via ClickFix-style social-engineering lures, establishing persistence through malicious shortcut (.lnk) files, and supporting remote command execution on infected hosts.

Why it matters for defenders

Loaders like AvisLoader sit at the front of an intrusion chain — they exist to get a foothold and then hand off to follow-on payloads, which could range from commodity malware to more targeted tooling. The P2P C2 design is notable because it removes much of the single-point-of-failure that defenders and takedown efforts typically rely on: sinkholing or blocking one C2 server is far less effective against a decentralized communication model. Because delivery leans on ClickFix-style lures (tricking users into running a malicious command themselves, often via a fake verification or fix prompt) and shortcut-based persistence, any organization where users can be socially engineered into executing commands or opening files is potentially at risk — this is not limited to a specific industry or region based on what's been reported so far.

What defenders should watch for

• User-execution patterns consistent with ClickFix lures, e.g., prompts instructing users to open the Run dialog or paste/execute a command manually.
• Creation or modification of .lnk shortcut files in startup, Recent, or common persistence locations, especially ones invoking powershell.exe, mshta.exe, or cmd.exe with obfuscated arguments.
• Outbound network behavior that doesn't match typical client-server C2 — look for connections to a changing/rotating set of peer IPs rather than a fixed small set of hosts.
• Encrypted or unusual traffic patterns on non-standard ports from endpoints that have no legitimate reason for peer-style network activity.
• General ClickFix-style defenses: user awareness training and restricting or logging use of the Run dialog, PowerShell, and other command-execution entry points from browser-driven prompts.

Developing intel

This writeup is based on a single vendor report (Varonis, via BleepingComputer) and no CVE or specific victim organizations have been disclosed. Details on indicators of compromise, prevalence, and attribution may evolve as more research is published. For the full technical breakdown, see the original article: Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption.