Diaoyu Loader Execution Guardrail Detection

nomit vyas@xoxo

•updated Feb 8, 2026•14•0•111

This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.