A recent spear-phishing targeted industrial and engineering companies in Europe, using GuLoader to deliver malware, including a remote access Trojan (RAT).
The goal of this campaign is to trick victims into downloading and executing attached files, such as .iso, .7z, .gzip, or .rar, that contain a batch file with an obfuscated PowerShell script. This script then downloads further files that execute malicious code, allowing hackers to gain access to compromised systems.
See also: Chinese hackers MirrorFace target European diplomats
Tara Gould, Threat Research Manager at Cado Security, warned that the emails come from a variety of addresses, including fake companies and compromised accounts, and often reuse existing emails.
GuLoader uses obfuscation techniques to avoid detection by security systems by executing malicious code through legitimate processes, making detection difficult.
The campaign targets employees at electronics manufacturing and engineering companies in countries such as Romania, Poland, Germany and Kazakhstan, with some scenarios also showing targets in the Netherlands and Croatia.
Read also: Spear-phishing campaign infects recruiters with the More_eggs backdoor
Cado Security has published indicators of compromise and Yara rules to help organizations search for evidence of a breach. The success of this campaign is due to GuLoader's ability to evade detection and deploy various final payloads without significant customization.
Source: helpnetsecurity
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
