Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 15:47:55 UTC
Home > List all groups > List all tools > List all groups using tool SymonLoader
 Tool: SymonLoader
Names SymonLoader
Category Malware
Type Loader
Description
(Palo Alto) When executed, the loader starts monitoring storage device changes on a
compromised machine. If SymonLoader detects the targeted type of secure USB drive, it
attempts to access the storage through the device driver corresponding to the secure USB
and checks for strings specific to one type of secure USB in the drive information fields.
Then, it accesses a predefined location of the storage on the USB and extracts an
unknown PE file.
Information
AlienVault OTX Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool SymonLoader
Changed Name Country Observed
APT groups
 Bronze Butler, Tick, RedBaldNight, Stalker Panda 2006-Apr 2021
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fbb29314-33cd-4170-9df9-801828cc3742
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fbb29314-33cd-4170-9df9-801828cc3742
Page 1 of 1