Loading story…
Check Point Research reported that GuLoader remains an actively developed malware downloader used to deliver commodity malware including Formbook, XLoader, Remcos, LokiBot, AgentTesla, NanoCore, NetWire, and 404Keylogger. Newer variants, particularly a VBScript-based infection chain, host encrypted shellcode and payloads on public cloud services such as Google Drive, then decrypt and execute them directly in memory to avoid dropping readable payloads to disk and to keep initial detection rates low.
The latest GuLoader samples also expand anti-analysis and evasion features. Researchers said the malware encrypts strings and payloads, obscures URLs until runtime, stores payloads in raw encrypted form without PE headers, and uses exception-driven control-flow obfuscation through access violations, trap-flag single-step exceptions, int3 breakpoints, and a vectored exception handler. The combination of cloud delivery, in-memory execution, and stronger sandbox and anti-debugging defenses has helped GuLoader remain a favored delivery mechanism for multiple malware families.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Morphisec Labs reported an active GuLoader campaign observed since April that primarily targeted U.S. law firms, as well as healthcare and investment firms. The phishing-led infection chain used PIN-protected PDF lures and staged PowerShell to fetch GuLoader shellcode from github.io and ultimately deploy Remcos RAT, and the report published associated malicious URLs and hashes.
The report described newer GuLoader versions as adding stronger anti-analysis features including sandbox evasion, anti-debugging, and exception-driven control-flow obfuscation using access violations, trap-flag single-step exceptions, and int3 breakpoints handled through a vectored exception handler. It also noted encrypted strings and payloads, runtime URL reconstruction, and storage of payloads without PE headers to bypass antivirus and cloud scanning.
Check Point Research reported that GuLoader had evolved into a cloud-based malware delivery mechanism, with newer VBScript-based variants hosting encrypted shellcode and payloads on public cloud services such as Google Drive. The analysis said the malware decrypts and executes content in memory while avoiding writing decrypted payloads to disk, helping it evade detection.
Outpost24 published research examining GuLoader's anti-virtual-machine behavior, documenting how the malware used VM-detection methods to hinder analysis and evade sandboxed environments. This represents an earlier documented stage of GuLoader's defensive tradecraft before the 2023 VBScript and cloud-hosting evolution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourceresearch.checkpoint.com
Open sourceoutpost24.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026
Researchers reported continued evolution in two prominent malware loaders used for financially motivated intrusions: **SocGholish** and **BLISTER**. Elastic said newer BLISTER variants hide malicious code inside legitimate DLLs, including **VLC Media Player** libraries, and add stronger evasion such as domain-based environmental keying, configurable anti-debugging, revised configuration fields, and unhooking techniques aimed at bypassing userland syscall-based EDR visibility. CloudSEK’s earlier analysis showed BLISTER using code-signed components, `rundll32.exe`, process hollowing, and Startup-folder persistence to deliver payloads including **Raccoon Stealer**, **Cobalt Strike Beacon**, and **BitRAT**, while Elastic linked more recent activity to deployment of the **MYTHIC** implant and to an updated **SocGholish** infection chain. Red Canary reported that **SocGholish** also changed delivery patterns, using ZIP-delivered JavaScript with filename obfuscation and **UTF-8 Cyrillic homoglyphs** to evade string-based detections, while selectively delivering second-stage malware in a subset of infections. Observed follow-on activity included host reconnaissance, Python-based persistence, browser credential theft, NTLM hash harvesting through forced authentication, and in some cases reported progression to **RansomHub** ransomware. Separate incident reporting from ReliaQuest showed how another JavaScript-based loader, **Gootloader**, enabled a long-dwell intrusion that escalated from SEO-poisoning and ZIP-delivered script execution to **SystemBC** access, LDAP discovery, Kerberoasting, RDP lateral movement, credential dumping, and exfiltration, underscoring how modern loaders are being refined as stealthy entry points for credential theft, post-exploitation, and ransomware operations.
Aug 15, 2026
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026