GuLoader is a highly obfuscated malware-as-a-service downloader that has evolved since 2019 to deliver secondary payloads such as RATs and information stealers. It employs polymorphic code for dynamic constant construction, exception-based control flow obfuscation using five distinct CPU exception types, encrypted strings with stack-based decryption, and modified DJB2 API hashing. Payloads are hosted on trusted cloud platforms (Google Drive, OneDrive) to evade reputation-based detection, and the malware continues to receive updates increasing analysis complexity.
Obfuscation
21 posts
GuLoader Malware Obfuscation Techniques Analyzed Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps A coordinated supply-chain campaign published 17 typosquatted npm and PyPI packages mimicking PaySafe, Skrill, and Neteller payment SDKs. The packages implement a fake SDK facade that harvests environment variables containing credentials and tokens, then exfiltrates them over HTTPS to an ngrok-based C2 server. The malware includes sandbox evasion logic and multi-layer C2 domain obfuscation to hinder analysis.
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus Google Threat Intelligence Group analyzed STOCKSTAY, a modular .NET backdoor developed and operated by Turla since late 2022, which uses a WebSocket-based C2 channel, RSA/AES encrypted communications, and IPC via WM_COPYDATA between its downloader, orchestrator, tunneler, and backdoor components. STOCKSTAY exhibits strong code, architectural, and obfuscation (K1MORPHER) overlaps with KAZUAR, suggesting a shared development team, and has been deployed via phishing (malicious RDP files, HTA lures) and, most recently, exploitation of CVE-2025-8088 in WinRAR to target Ukrainian military personnel. The actor leverages legitimate hosting platforms (Render, Glitch, GitHub) and compromised third-party/government infrastructure to obscure C2 infrastructure and complicate attribution.
ESET takes part in Operation Endgame to disrupt Amadey and Stealc ESET Research contributed to Operation Endgame, a coordinated global disruption targeting the Amadey botnet and Stealc infostealer MaaS ecosystems. The operation seized or rendered inoperative approximately 50 domains and nearly 200 active IP-based C&C servers. ESET provided technical analysis, C&C server lists, RC4 encryption keys, campaign/build identifiers, and clustering methodology based on long-term tracking of both malware families. The fragmented, affiliate-operated infrastructure model used by both services required advanced graph-based clustering of RC4 keys, build IDs, and C&C URL paths to identify high-priority targets for disruption.
Killing me gently: Inside Gentlemen’s EDR killer framework ESET researchers analyzed the Gentlemen ransomware-as-a-service (RaaS) operation, highlighting their unique approach of providing an in-house developed EDR killer framework, GentleKiller, directly to affiliates. The framework leverages Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate over 400 security processes and is augmented by third-party tools like HexKiller and HavocKiller, all standardized with a shared defense-evasion layer.
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners An npm package named shai_hulululud was discovered utilizing adversarial techniques to disrupt AI-assisted malware scanners. The package employs prompt injection, safety-triggering content, and context flooding via millions of tokens to cause LLM-based analysis tools to fail, truncate, or refuse processing before reaching the obfuscated JavaScript payload.
Technical Analysis of MLTBackdoor | ThreatLabz ThreatLabz has identified MLTBackdoor, a highly obfuscated post-exploitation framework delivered via ClickFix social engineering lures. The malware utilizes Mixed Boolean-Arithmetic (MBA), Control Flow Flattening (CFF), and indirect system calls to evade detection, while maintaining persistence and control through a custom encrypted protocol, a Domain Generation Algorithm (DGA), and a Beacon Object File (BOF) loader.
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open Multiple Russia-aligned threat actors, including SHADOW-EARTH-066 and Earth Dahu, are actively exploiting a patched WinRAR path traversal vulnerability (CVE-2025-8088) to target Ukrainian organizations. The attackers use crafted RAR archives with NTFS Alternate Data Streams to silently drop malicious payloads, such as the evolved GIFTEDCROOK infostealer or HTA-based espionage tools, into the Windows Startup folder and ProgramData directories.
From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises JS.MonoGlyphRAT is a newly identified, highly obfuscated JavaScript backdoor targeting US enterprises via phishing. It establishes persistence, communicates over HTTP using custom headers, and acts as a loader capable of executing AES-encrypted payloads, PowerShell commands, and in-memory .NET assemblies while bypassing AMSI.
Go Get ‘Em: Updates to Volexity Golang Tooling Volexity has released updates to its Golang reverse engineering tooling to address the growing trend of Go-based malware and obfuscation techniques like Garble. The release introduces GoStringExtractor, a plugin for IDA Pro and Ghidra that organizes unterminated Go string tables, and updates GoResolver to recover runtime type information (RTTI), significantly enhancing static analysis capabilities.
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files Gremlin stealer has evolved from a basic credential harvester into a sophisticated, modular infostealer capable of active financial fraud and live session hijacking. Recent variants employ advanced anti-analysis techniques, including Themida packing, .NET resource section payload hiding with XOR encryption, and extensive code obfuscation, significantly complicating static detection efforts.
FrostyNeighbor: Fresh mischief and digital shenanigans FrostyNeighbor, a Belarus-aligned threat actor, has updated its toolset to target Ukrainian governmental organizations with a multi-stage compromise chain. The attack utilizes spearphishing with malicious PDFs that redirect to a RAR archive containing a JavaScript dropper, which ultimately deploys a Cobalt Strike beacon via the PicassoLoader malware following strict server-side and manual victim validation.
GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access Google Threat Intelligence Group (GTIG) reports an escalation in adversaries leveraging generative AI for vulnerability discovery, autonomous malware orchestration, and defense evasion. Notable developments include the AI-assisted discovery of a zero-day 2FA bypass, the PROMPTSPY Android backdoor utilizing the Gemini API for autonomous UI navigation, and supply chain attacks by TeamPCP targeting AI dependencies like LiteLLM to extract cloud secrets.
lightning PyPI Package Compromised in Supply Chain Attack The popular PyPI package 'lightning' was compromised in a supply chain attack affecting versions 2.6.2 and 2.6.3. The malicious package executes an obfuscated JavaScript payload via the Bun runtime to harvest cloud and developer credentials, poison GitHub repositories by impersonating Anthropic's Claude Code, and infect local npm packages.
The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation Elastic Security Labs conducted research on the capabilities of Large Language Models (LLMs), specifically Claude Opus 4.6, to reverse engineer obfuscated binaries. The research demonstrates that while LLMs can defeat traditional obfuscation, novel techniques targeting LLM weaknesses—such as context window limits, budget caps, and shortcut biases—can effectively and cheaply disrupt automated static analysis pipelines.
From APT28 to RePythonNET: automating .NET malware analysis Sekoia TDR details their methodology for automating .NET malware analysis, focusing on an obfuscated Covenant Grunt implant used by APT28. The researchers demonstrate how to programmatically decrypt strings and decompile code using pythonnet and dnlib, culminating in the release of RePythonNET-MCP, a tool that enables AI-assisted reverse engineering and configuration extraction.
Latest Xloader Obfuscation Code & C2 Protocol | ThreatLabz Xloader is a highly obfuscated information stealer that evolved from Formbook. Recent versions (8.1+) introduce complex anti-analysis techniques, including out-of-order stack string construction and multi-layered RC4 encryption for its C2 communications, which utilize decoy servers to hide malicious traffic.
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads The highly popular Axios npm package was compromised when an attacker hijacked a lead maintainer's account to publish malicious versions. These versions included a phantom dependency that deployed a cross-platform Remote Access Trojan (RAT) via a postinstall hook, utilizing advanced obfuscation and anti-forensic techniques to hide its presence. The attack highlights critical risks in the software supply chain, specifically regarding dependency resolution and CI/CD pipeline protections.
5 Malicious npm Packages Typosquat Solana and Ethereum Libraries to Steal Private Keys A supply chain attack campaign utilizing five typosquatted npm packages targets Solana and Ethereum developers. The packages silently intercept private keys during routine cryptographic operations and exfiltrate them to a Telegram bot, leveraging transitive dependencies and obfuscation to evade detection.
China-nexus Group Targets Persian Gulf Region | ThreatLabz A China-nexus threat actor, assessed with medium confidence as Mustang Panda, targeted the Persian Gulf region using a multi-stage attack chain themed around the Middle East conflict. The campaign leverages LNK and CHM files to execute a heavily obfuscated shellcode loader via DLL sideloading, ultimately deploying a PlugX backdoor capable of HTTPS and DNS-over-HTTPS (DoH) C2 communications.
UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities Arctic Wolf Labs has identified a cyber espionage campaign by the Chinese-affiliated threat actor UNC6384 targeting European diplomatic entities. The campaign exploits the ZDI-CAN-25373 Windows shortcut vulnerability to deliver malicious LNK files, ultimately deploying the PlugX RAT via DLL side-loading of legitimate Canon printer utilities.
