Loading story…
Cisco Talos identified at least three malware-distribution campaigns using loaders that abuse the Heaven’s Gate technique to evade antivirus monitoring before downloading additional payloads. The campaigns delivered the HawkEye Reborn keylogger, the Remcos remote-access trojan, and cryptocurrency-mining malware.
Heaven’s Gate enables a nominally 32-bit process running on 64-bit Windows to escape the WOW64 compatibility layer and execute native 64-bit code, potentially bypassing security tools that do not adequately inspect cross-architecture execution. Windows 10 Control Flow Guard has reduced the technique’s effectiveness, but organizations operating legacy Windows systems remain more exposed to this evasion method.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Sophos identified Heaven’s Gate code in the Emotet trojan during the year of the report.
Malwarebytes observed cryptocurrency-mining malware abusing the Heaven’s Gate technique.
Cisco Talos reported at least three malware-distribution campaigns whose loaders used Heaven’s Gate to evade antivirus detection before installing additional payloads, including HawkEye Reborn, Remcos, and cryptocurrency-mining trojans.
Microsoft introduced Control Flow Guard in Windows 10, which blocked the Heaven’s Gate jump from WOW64 32-bit execution to native 64-bit code.
An anonymous member of the 29A virus-coding group, using the alias Roy G. Biv, documented the Heaven’s Gate technique in the mid-2000s.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 298 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
alex-ionescu.com
Open sourcezdnet.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied **TrickGate**, a shellcode-based packer and loader active since 2016, to the delivery of a wide range of malware families including **TrickBot, Emotet, REvil, Maze, Cerber, Formbook, AgentTesla, AZORult,** and **Cobalt Strike**. Check Point said the service has persisted through frequent wrapper changes and aliases while retaining the same core shellcode components, supporting the assessment that it is a single maintained operation used by multiple threat actors. Observed activity ranged from dozens to hundreds of attacks per week, typically beginning with phishing emails carrying archives, documents, or executables that launch a shellcode loader and inject the final payload while avoiding antivirus and EDR detection. Separate reporting from Cisco Talos described a related class of email-delivered loaders used to distribute **HawkEye Reborn**, **Remcos**, and cryptocurrency miners through malicious Office files exploiting `CVE-2017-11882`. The loader decrypted payloads only at runtime, hid them in PE resources, and used process hollowing into **RegAsm.exe**, API hashing, callback abuse, direct syscalls, and the **Heaven’s Gate** technique to evade monitoring under WOW64. Both reports show how long-lived loader services and packers have become shared infrastructure for cybercrime, enabling repeated delivery of stealers, RATs, and ransomware through stealthy in-memory execution and anti-analysis tradecraft.
Aug 15, 2026
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Researchers detailed how **GuLoader**—also tracked as **CloudEyE**—has operated as a long-running malware downloader that abuses legitimate cloud platforms such as **Google Drive** and **Microsoft OneDrive** to host encrypted second-stage payloads. First seen delivering **Parallax RAT**, the VB6-based loader was rapidly adopted by multiple threat actors and used to distribute a wide range of malware, including **Agent Tesla, FormBook, NanoCore, NetWire, Remcos, Vidar, RedLine, Raccoon**, and **Warzone RAT**. Reports tied the service to large-scale spam and archive-based delivery chains using invoice and COVID-19 lures, while one investigation linked the broader CloudEyE operation to a commercial malware protection and delivery service marketed to cybercriminals. Technical analyses showed GuLoader evolving to make detection and reverse engineering harder, with encrypted shellcode, code randomization, process injection, anti-debugging, anti-VM timing checks, hypervisor detection, and vectored exception handling that disrupts linear debugging. Researchers described samples that decrypted embedded loader components with XOR keys, allocated memory through hidden or indirect API calls, and executed payloads through callback-based shellcode techniques after staging files and PowerShell. Multiple teams also published methods to statically unpack the loader, recover drop URLs, and decode final payloads, underscoring the continuing enterprise risk from credential theft, remote access, and follow-on compromise delivered through this inexpensive malware-as-a-service platform.
Aug 15, 2026