LambLoad is a weaponized Windows downloader and loader created by adding malicious code to a legitimate, signed CyberLink application. Before running its malicious logic, it checks whether the host’s local date and time fall within a preconfigured execution window, helping restrict activation to intended victims. Microsoft associated the supply-chain compromise with Diamond Sleet and revoked the abused signing certificate. LambLoad’s role is to retrieve and launch additional payloads while hiding inside trusted software distributed through a legitimate update channel.