Loading story…
Check Point Research detailed Godzilla Loader, a malware downloader and dropper marketed on dark web forums as a low-cost alternative to Emotet, reportedly priced at about $500. Researchers said the malware appeared to have relatively limited infection volume, but it stood out for unusual implementation choices, particularly extensive use of COM objects for command-and-control, persistence, and execution that could help it evade behavioral sandbox analysis.
The malware also included a built-in UAC bypass using eventvwr.exe registry hijacking, RSA-2048 verification of C2 responses, and fallback infrastructure discovery through both a DGA and Twitter hashtags. Check Point said the loader was under active development with planned plugin support for propagation, keylogging, and password theft, underscoring how smaller malware offerings continue to compete in the cybercrime market by emphasizing feature sets and branding even when their operational scale remains modest.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point reported that the latest major version of Godzilla Loader had been in development since at least December of the previous year. The malware was described as under active development with new features being added over time.
Check Point Research published an analysis of Godzilla Loader, describing it as a dark-web advertised malware downloader/dropper sold for about $500 and positioned against loaders such as Emotet. The report detailed its COM-heavy design, built-in UAC bypass, RSA-2048 C2 verification, DGA and Twitter fallback mechanisms, and planned plugin support for propagation, keylogging, and password theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that **GuLoader** remains an actively developed malware downloader used to deliver commodity malware including **Formbook, XLoader, Remcos, LokiBot, AgentTesla, NanoCore, NetWire,** and **404Keylogger**. Newer variants, particularly a **VBScript-based** infection chain, host encrypted shellcode and payloads on public cloud services such as **Google Drive**, then decrypt and execute them directly in memory to avoid dropping readable payloads to disk and to keep initial detection rates low. The latest GuLoader samples also expand anti-analysis and evasion features. Researchers said the malware encrypts strings and payloads, obscures URLs until runtime, stores payloads in raw encrypted form without PE headers, and uses exception-driven control-flow obfuscation through access violations, trap-flag single-step exceptions, `int3` breakpoints, and a vectored exception handler. The combination of cloud delivery, in-memory execution, and stronger sandbox and anti-debugging defenses has helped GuLoader remain a favored delivery mechanism for multiple malware families.
Aug 14, 2026
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026
Researchers tied **TrickGate**, a shellcode-based packer and loader active since 2016, to the delivery of a wide range of malware families including **TrickBot, Emotet, REvil, Maze, Cerber, Formbook, AgentTesla, AZORult,** and **Cobalt Strike**. Check Point said the service has persisted through frequent wrapper changes and aliases while retaining the same core shellcode components, supporting the assessment that it is a single maintained operation used by multiple threat actors. Observed activity ranged from dozens to hundreds of attacks per week, typically beginning with phishing emails carrying archives, documents, or executables that launch a shellcode loader and inject the final payload while avoiding antivirus and EDR detection. Separate reporting from Cisco Talos described a related class of email-delivered loaders used to distribute **HawkEye Reborn**, **Remcos**, and cryptocurrency miners through malicious Office files exploiting `CVE-2017-11882`. The loader decrypted payloads only at runtime, hid them in PE resources, and used process hollowing into **RegAsm.exe**, API hashing, callback abuse, direct syscalls, and the **Heaven’s Gate** technique to evade monitoring under WOW64. Both reports show how long-lived loader services and packers have become shared infrastructure for cybercrime, enabling repeated delivery of stealers, RATs, and ransomware through stealthy in-memory execution and anti-analysis tradecraft.
Aug 15, 2026