Executive Summary
In early 2026, an undocumented malware campaign dubbed BoldTealLayer was discovered utilizing a highly evasive Lua-wrapped loader. The attack chain begins with a legitimate, digitally signed KuGou executable (active_desktop_launcher.exe) which side-loads a malicious DLL (active_desktop_render_x64.dll). This DLL acts as an orchestrator, leveraging a Lua 5.1 engine to execute obfuscated scripts that systematically dismantle Windows security features before injecting a .NET payload into memory.
The loader demonstrates advanced tradecraft by patching Event Tracing for Windows (ETW), unhooking ntdll.dll using a clean copy from KnownDlls, and employing hardware breakpoints (DR0) to bypass the Antimalware Scan Interface (AMSI). Despite its sophistication, the malware left a plaintext debug log, lua_traceback.log, in C:\temp, which provided the primary intelligence for this analysis.
This threat is significant due to its zero-detection rate across major antivirus engines at the time of discovery. The campaign appears to be part of a broader operation originating from a distribution server at 143.92.51[.]20, potentially delivering banking Trojans such as Zusy.