Attacks and malware
What is Loader?
Malware whose main job is to get a foothold and then download and run other malware, often sold to several criminal groups.
A loader is first-stage malware whose main job is to establish a foothold and then fetch and run the next payload: a remote access tool, an infostealer or ransomware tooling. Some loaders also profile the victim first, so operators can decide who is worth more effort.
Loaders are often run as a service, delivering other criminals' malware for a fee. That is why law enforcement operations frequently target them: removing one loader cuts off many downstream groups.