CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Factory-v3

tool · tool:factory-v3-loader-builder single-source

Malware-as-a-service Go loader-builder documented by Palo Alto Unit 42 (2026-07-07) delivering Vidar stealer and XMRig via fraudulent Authenticode code-signing, fake MpClient.dll DLL-sideloading against Defender, in-memory AMSI patching and 'file inflation' (null-padding to ~491 MB) sandbox evasion; operator tracked via a Telegram channel branded 'X3D MINER'.

Coverage
1
first 2026-07-08 → last 2026-07-08
Latest activity
2026-07-08
Unit 42: Factory-v3 loaders use fake Authenticode signing and 491 MB file inflation to evade sandboxes
Peak priority
notable
1 notable
Targets
technology
sectors: technology · regions: us, europe
Sources cited
1
1 hosts

Action items (2)

Do-now tasks recorded on the entries about Factory-v3, newest first. Check the date before acting on an older one.

Defender insights

What each entry about Factory-v3 tells a defender to do, newest first.

Story timeline

  1. 2026-07-08Unit 42: Factory-v3 loader-builder abuses fraudulent code-signing and 491 MB file inflation to smuggle Vidar and XMRig past sandboxes
    active-threatsUnit 42: Factory-v3 loaders use fake Authenticode signing and 491 MB file inflation to evade sandboxes

Hunting pivots

Tags
cryptocrimeinfostealerphishing
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • ExecutionHijack Execution Flow: DLL
  • StealthHijack Execution Flow: DLL
  • Defense ImpairmentSubvert Trust Controls: Code Signing · Disable or Modify Tools

Execution TA0002

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-08/unit42-factory-v3-loader-vidar-xmrig-sandbox-evasion · ATT&CK page ↗

Stealth TA0005

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-08/unit42-factory-v3-loader-vidar-xmrig-sandbox-evasion · ATT&CK page ↗

Defense Impairment TA0112

T1553.002Subvert Trust Controls: Code Signing×1

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.

Evidence: 2026-07-08/unit42-factory-v3-loader-vidar-xmrig-sandbox-evasion · ATT&CK page ↗

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-08/unit42-factory-v3-loader-vidar-xmrig-sandbox-evasion · ATT&CK page ↗

Entries about Factory-v3 (1)

2026-07-08 · view entry permalink →

NOTABLENATOB2

Unit 42: Factory-v3 loader-builder abuses fraudulent code-signing and 491 MB file inflation to smuggle Vidar and XMRig past sandboxes

Unit 42 documented a financially motivated malvertising campaign, active since April 2026, distributing Vidar stealer and the XMRig cryptominer via loaders built with "Factory-v3", a malware-as-a-service Go loader-builder (Unit 42, 2026-07-07). Victims are lured to password-protected archives masquerading as cracked software; the Go loaders (43 samples, 27 unique build UUIDs, defeating hash-based detection) are signed with fraudulent Authenticode certificates impersonating real companies (JustWatch GmbH, later BleacherReport) (T1553.002), strip PE metadata, and DLL-sideload via a fake MpClient.dll export that hijacks Windows Defender's DLL search order to execute as NisSrv.exe from AppData (T1574.002). Before dropping the payload the loader patches AMSI in memory, resolving AmsiScanBuffer and overwriting its first six bytes to force an E_INVALIDARG return (T1562.001). The standout evasion is "file inflation": appending hundreds of megabytes of null bytes to push loader size to as high as 491 MB, exceeding the 50–100 MB detonation limits of many automated sandboxes. Persistence uses Run keys, scheduled tasks and startup-folder scripts, and each victim is fingerprinted via an 8-character HWID; the operator monitors yield through a Telegram channel branded "X3D MINER".

Loaders in Clusters A and C append hundreds of megabytes of null bytes after the last PE section, pushing the total file size to as high as 491 MB

The builder generates a unique binary per build. For example, we observed 27 unique build UUIDs across 43 samples, defeating hash-based detection

Palo Alto Networks Unit 42 2026-07-07
threat08 Jul 20:35Zsingle-sourceOpen finding →
Sources: Palo Alto Networks Unit 42

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • unit42.paloaltonetworks.com1 (100%)
All cited sources (1)