Loading story…
Attackers are distributing Guloader malware through phishing emails that masquerade as employee performance reports, exploiting workplace trust and urgency to trick recipients into opening malicious attachments. The emails, purporting to be from HR or management and referencing October 2025 performance reviews, use psychological manipulation by suggesting potential dismissals, increasing the likelihood that employees will open the attached file. The attachment is a compressed archive containing an executable file disguised as a PDF (e.g., 'staff record pdf.exe'), which, if file extensions are hidden, appears innocuous but actually initiates a multi-stage infection process upon execution.
Once launched, the executable connects to a remote server—specifically a Google Drive URL—to download encrypted shellcode and further payloads. The infection chain ultimately leads to the deployment of Guloader, which can then download additional malware such as Remcos RAT, providing attackers with persistent access and control over the victim's system. This campaign leverages trusted cloud services to evade detection and highlights the ongoing evolution of social engineering tactics targeting organizations through familiar business processes and documents.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Reporting on the campaign disclosed that Guloader uses a multi-stage, memory-resident infection chain, downloading encrypted shellcode or additional payload components from Google Drive to evade detection. The final Remcos RAT payload was observed communicating with command-and-control server 196.251.116.219 over ports 2404 and 5000.
AhnLab Security Intelligence Center (ASEC) reported a phishing campaign using fake October 2025 employee performance review emails, often with layoff-themed language, to trick recipients into opening a malicious archive. The attachment masquerades as a PDF but launches Guloader, which ultimately installs Remcos RAT for surveillance and credential theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are distributing the Guloader malware through phishing emails disguised as employee performance reports. These emails claim to provide information about staff evaluations and potential dismissals, enticing recipients to open a compressed RAR file attachment. The archive contains an executable file named to appear as a PDF document, which, when run, deploys Guloader. This malware then downloads and executes shellcode from a remote server, ultimately installing Remcos RAT on the victim's system. Remcos RAT enables attackers to perform a range of malicious activities, including keylogging, screenshot capture, webcam and microphone control, and the extraction of browser histories and passwords. The campaign leverages legitimate cloud storage services for command and control, increasing the difficulty of detection. Security researchers have provided indicators of compromise, such as specific MD5 hashes and C2 addresses, to aid in defense against this threat. Users are advised to exercise caution with unexpected emails and regularly update passwords to mitigate risk.
Jun 29, 2026
Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as *Microsoft Teams*, *Zoom*, and *Adobe Acrobat Reader* installers (e.g., `msteams.exe`, `zoomworkspace.clientsetup.exe`, `adobereader.exe`, `invite.exe`) that appeared trustworthy because they were **digitally signed** with an Extended Validation (EV) certificate issued to **TrustConnect Software PTY LTD**. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls. After execution, the signed malware deployed **remote monitoring and management (RMM)** tooling—reported examples include **ScreenConnect**, **Tactical RMM**, and **Mesh Agent**—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing **malicious ISO attachments** embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.
Jun 29, 2026
A China-aligned threat actor known as UTA0388 has been conducting a series of sophisticated spear-phishing campaigns targeting organizations and individuals across North America, Asia, and Europe. The campaigns, first observed in April 2025, have evolved in both their technical execution and social engineering tactics. UTA0388 crafts highly tailored phishing emails that appear to originate from senior researchers or analysts at legitimate-sounding but entirely fictitious organizations. These emails are sent in multiple languages, including English, Chinese, Japanese, French, and German, to increase their credibility and reach a broader set of targets. Initially, the phishing messages contained links to malicious archives hosted on cloud services or attacker-controlled infrastructure, which, when accessed, delivered a ZIP or RAR file containing a rogue DLL payload. This payload is launched using DLL side-loading techniques, a method that leverages legitimate executables to load malicious code, thereby evading some security controls. The primary malware delivered in these campaigns is a Go-based backdoor named GOVERSHELL, which is under active development and has been observed in at least five distinct variants. Earlier versions, such as HealthKick, allowed attackers to execute commands via cmd.exe, while later variants like TE32 and TE64 introduced PowerShell reverse shell capabilities and other enhancements. The campaigns have shifted from broad, one-off phishing attempts to more targeted, rapport-building approaches, where attackers engage in extended email conversations to build trust before delivering the malicious link. This evolution in social engineering demonstrates a significant increase in operational security and effectiveness. Volexity, which tracks this activity, notes that the technical artifacts and targeting profile strongly indicate a China-aligned threat actor. The GOVERSHELL malware is considered a successor to the earlier HealthKick family, with improvements in command execution and persistence. The activity also overlaps with a cluster tracked by Proofpoint as UNK_DropPitch, suggesting a broader campaign infrastructure. The use of multiple languages and tailored lures indicates a high level of preparation and reconnaissance by UTA0388. The campaigns have targeted a range of sectors, with the intent to gain persistent access to sensitive systems and exfiltrate data. The attackers' use of legitimate-looking filenames and organizations increases the likelihood of successful compromise. Security researchers recommend heightened vigilance for spear-phishing attempts, especially those involving unsolicited communications from unknown but plausible sources. Organizations are advised to monitor for DLL side-loading activity and to educate users about the risks of opening archives from unverified senders. The ongoing development of GOVERSHELL and the adaptive phishing techniques suggest that UTA0388 will continue to pose a significant threat to organizations worldwide.
Jun 29, 2026