SynkLoader: the lock screen plus the tunnel

PhishLocker is a fake Windows lock screen. The password plus the tunnel is the prize.

On 18 August, Expel caught SynkLoader off a scheduled-task EDR hit that started in Microsoft Teams and ended in a fake lock screen. The EDR alert was the first clean look at a loader nobody had published yet. File times and compile stamps ran back to about 28 July. They named it SynkLoader. No crew name came with it.

How SynkLoader arrives in Microsoft Teams

The user had already been talked through the install in Microsoft Teams. The other side of the chat sat on an onmicrosoft.com tenant and used the display name IT Service Desk. Expel never recovered the full transcript. They got enough metadata to see the desk, and enough on disk to see what got installed: an MSI from Azure Blob Storage at filereserve.blob.core.windows.net, file 331.msi, product name PowershellCleaner. It borrows Microsoft's brand if you do not read the path twice.

What the PowerShellCleaner MSI runs after install

The installer wrote cleaner.ps1 and archive6.zip under LocalAppData, unpacked a Python tree into a random 16-character folder under AppData, and started pythonw.exe with ss.py from fl\ang. Persistence did not go through schtasks.exe. A COM ITaskService task with a random 12-character name ran that same pythonw line at user logon and again at 10:00 local.

The fake Windows lock screen (PhishLocker)

Inside that Python process, PhishLocker painted a full-screen fake Windows lock screen. It pulled the wallpaper from C:\Windows\Web\Screen and asked for the password that the user already types every morning. It does not check the password. Alt+Tab still works. The point is the secret, not a real lock.

The TrafficRedirector tunnel

TrafficRedirector is the other half. It is a backconnect proxy that leaves through the victim's own IP. Internal LAN and Internet services both see the user. Geo alerts and IP allow-lists do not. Expel wrote that this is what the stolen password, plus the tunnel, is built to do. They did not publish a screenshot of the attacker-as-user Entra sign-in. Same-IP cloud login stays inferred.

What the operator did next

The C2 does not only drop those two modules. It sends Python, and the loader execs it in memory. Expel stood up a logger, then a reverse-shell emulator, fed it a fake large AD, and waited. Once the operator thought they had a network, they ran a reverse shell and a VNC-style stream of the live desktop, StreamMaster. That is the work after the bait, not a row in an IOC table.

What they want

What they wanted from a real victim is still open. The profiler counts AD computers. That AD_counter field is why Expel said ransomware group or initial-access broker, low to medium confidence. They did not find a ransomware payload on the client. Do not hunt a family name. Hunt the lock screen and the tunnel.

Hunts

KQL

Loader first. This is not an Entra same-IP join.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where (
    FileName =~ "pythonw.exe"
    and FolderPath has @"AppData\Roaming"
    and (ProcessCommandLine has "ss.py" or FolderPath has @"\fl\ang")
  ) or (
    FileName =~ "msiexec.exe"
    and (ProcessCommandLine has "331.msi"
      or ProcessCommandLine has "PowershellCleaner"
      or ProcessCommandLine has "filereserve.blob.core.windows.net")
  )
| project Timestamp, DeviceName, AccountUpn, FileName, FolderPath, ProcessCommandLine, SHA256

Falcon CQL

LogScale / Next-Gen SIEM. TaskExecCommand and TaskExecArguments are confirmed on CrowdStrike's OverWatch writeup.

#event_simpleName=ProcessRollup2 event_platform=Win
| FileName=/^(?i)pythonw\.exe$/
| CommandLine=/(?i)(ss\.py|fl\\ang|PowershellCleaner)/

#event_simpleName=ProcessRollup2 event_platform=Win
| FileName=/^(?i)msiexec\.exe$/
| CommandLine=/(?i)(331\.msi|PowershellCleaner|filereserve\.blob\.core\.windows\.net)/

#event_simpleName=ScheduledTaskRegistered event_platform=Win
| TaskExecCommand=/(?i)pythonw\.exe/ or TaskExecArguments=/(?i)(ss\.py|fl\\ang)/

Splunk

Named indexes. Rename if yours differ. Sysmon network: dest_host and DestinationHostname.

(index=sysmon OR index=windows) sourcetype=*Sysmon* EventCode=1
  (
    (Image="*\\msiexec.exe" AND (CommandLine="*331.msi*" OR CommandLine="*PowershellCleaner*" OR CommandLine="*filereserve.blob.core.windows.net*"))
    OR (Image="*\\pythonw.exe" AND (CommandLine="*ss.py*" OR CommandLine="*\\fl\\ang\\*"))
    OR (Image="*\\powershell.exe" AND CommandLine="*cleaner.ps1*")
  )
OR (index=sysmon sourcetype=*sysmon* EventCode=3
    (dest_host IN (neversoftmain.net, rootfarmapp.net, tripinupdate.net, dondermicapp.net, aroclenetapp.net)
     OR DestinationHostname IN (neversoftmain.net, rootfarmapp.net, tripinupdate.net, dondermicapp.net, aroclenetapp.net)))
OR (index=proxy (url="*filereserve.blob.core.windows.net*" OR url="*331.msi*"))

Kibana

(process.name:pythonw.exe AND (process.command_line:*ss.py* OR process.command_line:*\\fl\\ang* OR process.executable:*\\fl\\ang*))
OR (process.name:msiexec.exe AND (process.command_line:*331.msi* OR process.command_line:*PowershellCleaner* OR process.command_line:*filereserve.blob.core.windows.net*))
OR (dns.question.name:(neversoftmain.net OR rootfarmapp.net OR tripinupdate.net OR dondermicapp.net OR aroclenetapp.net))

Sources

Expel, "SynkLoader: when you throw in everything but the kitchen sink," 20 August 2026.

What This Means for Your Team

A Teams IT Service Desk chat is enough to get a user to install an MSI. After that, the lock screen is the credential theft and the tunnel is why geo and allow-lists miss it. If pythonw is launching ss.py from AppData, treat the password as gone. Hunt that on the endpoint. Do not wait for a ransomware family name.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We use the Defender, Sentinel, Conditional Access, and Azure licenses you already have. We hunt Teams lures, odd MSI installs, fake lock-screen behavior, and identity use that does not look like the user.

Assessing Your Security Posture

Want to see where your environment stands? Grab our free Inception Foresight M365 Assessment (https://www.inceptionsecurity.com/m365assessment). No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on X.