Loading story…
Elastic Security Labs analyzed a GULOADER (CloudEyE) campaign in which the shellcode downloader was delivered in an NSIS installer and used System.dll to allocate and execute encrypted payloads. The malware invoked callback-capable Windows APIs, including EnumResourceTypesA and CallWindowProcW, to launch its shellcode.
GULOADER expanded its vectored exception handler (VEH)-based anti-analysis protections by handling privileged- and illegal-instruction exceptions, checking for hardware breakpoints, and altering the instruction pointer through the exception CONTEXT record to obscure control flow. Windows supplies VEH handlers with EXCEPTION_POINTERS, which contains an EXCEPTION_RECORD and processor-state CONTEXT; the malware abuses this state to redirect execution. Elastic published exception-tracing and patching techniques, YARA rules, and campaign observables to support detection and reverse engineering.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs analyzed a fresh GULOADER (CloudEyE) campaign in which an NSIS-packaged downloader used additional vectored-exception-handler paths for privileged and illegal instructions, hardware-breakpoint checks, and EIP redirection to obstruct analysis. Elastic published the Windows_Trojan_Guloader YARA rule and associated campaign observables, including a C2 URL and IP address.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that **GuLoader** remains an actively developed malware downloader used to deliver commodity malware including **Formbook, XLoader, Remcos, LokiBot, AgentTesla, NanoCore, NetWire,** and **404Keylogger**. Newer variants, particularly a **VBScript-based** infection chain, host encrypted shellcode and payloads on public cloud services such as **Google Drive**, then decrypt and execute them directly in memory to avoid dropping readable payloads to disk and to keep initial detection rates low. The latest GuLoader samples also expand anti-analysis and evasion features. Researchers said the malware encrypts strings and payloads, obscures URLs until runtime, stores payloads in raw encrypted form without PE headers, and uses exception-driven control-flow obfuscation through access violations, trap-flag single-step exceptions, `int3` breakpoints, and a vectored exception handler. The combination of cloud delivery, in-memory execution, and stronger sandbox and anti-debugging defenses has helped GuLoader remain a favored delivery mechanism for multiple malware families.
Aug 14, 2026
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026
Financially motivated threat actors have abused an illicit copy of the commercial **Shellter Elite v11.0** evasion framework since late April 2025 to build a loader delivering Lumma Stealer, ARECHCLIENT2/SECTOP RAT, and the Rhadamanthys information stealer. The campaigns used file-hosting links, phishing lures aimed at content creators, and malicious YouTube comments to distribute payloads; a shared embedded license-expiry timestamp indicates many samples may have been produced using a single compromised or illicit license. The observed SHELLTER loader encrypts payloads with **AES-128-CBC** and employs polymorphic shellcode, `ntdll` remapping and unhooking, indirect system calls, call-stack corruption, AMSI bypasses, debugger and sandbox checks, and vectored-exception-handler API proxying to hinder detection and analysis. Elastic Security Labs released YARA rules and a dynamic unpacker to help defenders identify and inspect the malicious loader and its embedded malware.
Sep 9, 2026