Loading story…
Sophos reported a newly observed infection chain used by the GOLD BLADE cybercriminal group to deploy its custom RedLoader malware through job-themed lures sent via third-party employment sites. Victims were directed to download a ZIP archive containing a malicious .lnk file disguised as a PDF; when opened, the shortcut launched conhost.exe, used WebDAV to fetch a renamed, signed Adobe ADNotificationManager.exe from attacker-controlled infrastructure, and remotely sideloaded a malicious netutils.dll as RedLoader stage 1.
The malware then established persistence with a scheduled task named BrowserQE containing a Base64-encoded computer name, downloaded a standalone stage 2 payload from a separate Cloudflare Workers domain, and executed it through PCALua.exe and conhost.exe before initiating command-and-control activity. Sophos said the chain combined two techniques previously associated with GOLD BLADE—WebDAV-hosted DLL execution and renamed ADNotificationManager.exe sideloading—in a way not publicly documented before, and recommended defenses including blocking .lnk execution from common user directories and monitoring for DLL sideloading, suspicious conhost.exe child processes, and RedLoader stage 2 behavior.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On publication of its report, Sophos said the campaign combined WebDAV-hosted DLL execution with renamed ADNotificationManager.exe sideloading in a way that had not been publicly reported before. The company also published mitigations and detections for LNK abuse, DLL sideloading, suspicious conhost.exe child processes, and RedLoader stage 2.
During the same July 2025 intrusion chain, RedLoader stage 1 created a scheduled task named BrowserQE containing a Base64-encoded computer name, then downloaded a standalone stage 2 executable from a Cloudflare Workers domain. The malware executed the second stage via PCALua.exe and conhost.exe to continue command-and-control activity.
In July 2025, Sophos observed a GOLD BLADE infection chain using job-themed lure PDFs distributed via third-party job sites such as Indeed. Victims were led to a ZIP archive containing a malicious LNK that launched conhost.exe, retrieved a renamed Adobe ADNotificationManager.exe over WebDAV, and remotely sideloaded a malicious netutils.dll to deploy RedLoader.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported continued evolution in two prominent malware loaders used for financially motivated intrusions: **SocGholish** and **BLISTER**. Elastic said newer BLISTER variants hide malicious code inside legitimate DLLs, including **VLC Media Player** libraries, and add stronger evasion such as domain-based environmental keying, configurable anti-debugging, revised configuration fields, and unhooking techniques aimed at bypassing userland syscall-based EDR visibility. CloudSEK’s earlier analysis showed BLISTER using code-signed components, `rundll32.exe`, process hollowing, and Startup-folder persistence to deliver payloads including **Raccoon Stealer**, **Cobalt Strike Beacon**, and **BitRAT**, while Elastic linked more recent activity to deployment of the **MYTHIC** implant and to an updated **SocGholish** infection chain. Red Canary reported that **SocGholish** also changed delivery patterns, using ZIP-delivered JavaScript with filename obfuscation and **UTF-8 Cyrillic homoglyphs** to evade string-based detections, while selectively delivering second-stage malware in a subset of infections. Observed follow-on activity included host reconnaissance, Python-based persistence, browser credential theft, NTLM hash harvesting through forced authentication, and in some cases reported progression to **RansomHub** ransomware. Separate incident reporting from ReliaQuest showed how another JavaScript-based loader, **Gootloader**, enabled a long-dwell intrusion that escalated from SEO-poisoning and ZIP-delivered script execution to **SystemBC** access, LDAP discovery, Kerberoasting, RDP lateral movement, credential dumping, and exfiltration, underscoring how modern loaders are being refined as stealthy entry points for credential theft, post-exploitation, and ransomware operations.
Aug 15, 2026
Researchers documented two separate but related **LNK-driven intrusion chains** that used shortcut files as the initial lure to fetch additional malware from attacker-controlled infrastructure. In one campaign targeting organizations in the **Arabian Gulf region**, a China-nexus threat actor used a Middle East conflict-themed ZIP archive containing an LNK file that downloaded a malicious CHM file and ultimately deployed a **PlugX** backdoor. The infection chain progressed through a second LNK, a TAR archive, DLL sideloading, and a shellcode loader before installing PlugX with persistence under a fake Microsoft Display Broker path and service name. The malware used RC4-encrypted components, API hooking, reflective DLL loading, corrupted PE headers, and support for **TCP, HTTPS, UDP, and DoH** communications, with a decrypted command-and-control endpoint at `91.193.17[.]117:443` and plugins for keylogging, shell access, screen capture, registry, service, and network operations. A second investigation exposed a live **LNK-to-DLL-to-.NET RAT** operation staged from an open Apache directory on `wildishadventure[.]com/secure9/` and `171.22.182[.]231/secure9/`, where researchers recovered weaponized LNK files, custom DLL downloaders, backup files, and a final payload named `RemoteMgmt.Agent.exe`. That chain abused the legacy `ActiveXObject('htmlfile')` technique to force Windows to retrieve DLLs over UNC paths, then delivered a custom .NET 4.8 remote access trojan that supported command execution, token-based authentication, JSON-over-raw-TCP C2 over port 443, reconnect-based persistence, and logging to `%TEMP%\rmgmt_agent.log`. Operational security failures including exposed directory indexing, `.old` backups, test builds, and unstripped internal names allowed investigators to reconstruct the malware’s development workflow and identify infrastructure spanning **BlueVPS**, **Namecheap**, and **Cloudflare**.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026