Encrypted Peer‑to‑Peer Network Fuels New Windows Loader Called AvisLoader

Researchers have uncovered a new Windows malware loader named AvisLoader that uses encrypted P2P traffic to protect its C2 infrastructure from takedown. First spotted by Varonis, it seems built to remain functional even when conventional server‑based setups are disrupted.

The study shows AvisLoader is usually dropped through a malicious component called ClickFix, which is hidden in compromised installers or masquerades as legitimate software updates. When run, the loader creates persistence by dropping a Windows shortcut (LNK) in the startup folder, causing it to launch at each boot. This straightforward technique bypasses many basic detection rules that target registry or service changes.

Once established, AvisLoader starts encrypted P2P communication with other infected machines. By using a distributed mesh instead of a single C2 server, the malware can receive commands, fetch extra payloads, or exfiltrate information while making network‑level blocking far more challenging. The added encryption further masks traffic signatures, reducing the efficacy of signature‑based IDS.

Researchers point out that the loader’s remote command execution is modular. Attackers can deliver a range of secondary malware—from credential stealers to ransomware droppers—tailored to the victim’s characteristics. This adaptability mirrors patterns seen in other loader families that serve as delivery platforms rather than isolated threats.

Analysts caution that the mix of shortcut‑based persistence, encrypted P2P networking, and modular design makes AvisLoader especially durable. Companies should watch for unusual shortcut files in startup paths, enforce strict application whitelisting, and deploy behavioral analytics capable of spotting abnormal peer‑to‑peer traffic on corporate networks. As defenses evolve, AvisLoader’s rise highlights the continual cat‑and‑mouse game between malware developers and security teams, underscoring the need for ongoing threat‑intel feeds and layered security approaches.