Loaders, MaaS, and Nation-State APTs

• Loaders / droppers: small first-stage that fetches and runs the real payload. Examples: QakBot, IcedID, Emotet, Bumblebee.
• Malware-as-a-Service: rent infrastructure, crypters, and pay-per-install distribution.
• Nation-state APTs: long-dwell, objective-driven intrusions.
• Stuxnet (2010) — sabotage of Iranian centrifuges; our Lab 5 capstone case study.
• Volt Typhoon — LOTL intrusions into critical infrastructure.
• Different actors, same analysis skills: the binary still has to run on a CPU.