LausivLoader: How a Malicious Fiber-Optic Quote Request Chains Multiple Loader Stages

The SANS Internet Storm Center reports on a malspam campaign, first captured in a customer mail gateway's quarantine at the end of August 2026, that impersonates an employee of a legitimate company requesting a price quotation for a fiber optic system. The lure references attached "requirements" documents. ISC's analysis focuses on a loader dubbed LausivLoader and how it passes data between successive infection stages.

Why It Matters for Defenders

Business-themed procurement lures (RFQs, quotations, requirements documents) remain an effective social-engineering vector because they mimic routine vendor correspondence and often bypass user suspicion. A multi-stage loader architecture like the one described is also significant from a detection standpoint: each stage typically exists to evade static analysis and sandboxing by deferring the delivery of the final payload, and understanding how data is handed off between stages is key to detecting the chain at any single point of failure rather than relying on one signature.

What Defenders Should Watch For

• Inbound email impersonating vendors or employees requesting quotes on hardware/infrastructure (e.g., fiber optic, networking equipment), especially with attached "requirements" documents.
• Multi-stage execution chains originating from office documents or archive attachments — hunt for parent/child process anomalies where a document viewer or script host spawns downloader or loader activity.
• Unusual inter-process or inter-stage data handoff mechanisms (e.g., staged payloads written to disk, registry, or passed via named pipes/environment variables) that loaders use to avoid dropping a full payload at once.
• Mail gateway and attachment-sandboxing telemetry for quarantined messages matching this procurement-lure pattern, which can provide early warning before a stage executes on an endpoint.

This is based on a single ISC diary entry and reflects developing intelligence on one observed sample chain — technical specifics of each loader stage, the final payload, and any broader campaign attribution are not yet established here. For full technical detail, see the original SANS ISC diary: https://isc.sans.edu/diary/rss/33348.