donut_injector
Also known as: Donut
Donut is an open-source in-memory injector/loader, designed for execution of VBScript, JScript, EXE, DLL files and dotNET assemblies. It was used during attacks against U.S. organisations according to Threat Hunter Team (Symantec) and U.S. Defence contractors (Unit42).
Github: https://github.com/TheWover/donut
C2 Infrastructure
Last 7 days
| Date | C2 Hosts |
|---|---|
| Apr 14, 2026 | 18 |
| Apr 13, 2026 | 11 |
| Apr 12, 2026 | 2 |
| Apr 11, 2026 | 9 |
| Apr 9, 2026 | 5 |
| Apr 8, 2026 | 1 |
Further Reading
﷽
Analysis of malicious infrastructure targeting Israeli entities via payloads delivered through compromised WordPress sites in 2023.
Attackers were preparing to attack dozens of U.S. corporations, including eight Fortune 500 companies.
TLDR: You can now inject .NET Assemblies into Windows processes using this repo: https://github.com/TheWover/donut/
Swiss Post Cybersecurity detected and analyzed an infostealer campaign. The attackers use Clickfix for initial access and DonutLoader for shellcode delivery. In our blog article, we show you step b...