“Wslink”, a previously undisclosed malware loader for Windows binaries, was recently discovered this week by ESET researchers and identified as targeting North America, Central Europe, and the Middle East. Wslink is noted as unique by ESET, in their report linked below, for its capability of running as a server and executing received modules in memory. Researchers explained that “there are no code, functionality or operational similarities that suggest this is likely to be a tool from a known threat actor group” yet emphasized that the malware features a “well-developed cryptographic protocol to protect the exchanged data” involved during the handshake between the victim machine and the Wslink server. When the malware establishes a connection to a specified IP address and port, a handshake is conducted to exchange cryptographic keys in order to encrypt the modules. The report also explained that Wslink reuses its own functions for “communication, keys and sockets” so that a new outbound connection does not need to be established. ESET researchers provide a sample walkthrough of the malware’s processes as well as a short list of indicators of compromise (IOCs) at the conclusion of their report.