9/4/25, 2:27 PM

Researchers from Cado Security Labs (now part of Darktrace) identified a campaign named GuLoader targeting European industrial and engineering companies, with spearphishing emails carrying archive attachments such as iso, 7z, gzip or rar to deliver the malware. The emails were sent from various addresses including fake companies or compromised accounts and typically hijacked existing threads or requested order information.

The campaign uses an evasive batch file containing an obfuscated PowerShell script, followed by a second PowerShell stage that loads additional shellcode and eventually injects into a legitimate process to deliver Remote Access Trojans. The attackers have shown ongoing evolution, including anti-debugging techniques and persistence mechanisms, with indicators pointing to payloads including Remcos, NetWire and AgentTesla.

Initial targets included electronic manufacturing, engineering and industrial firms in European countries such as Romania, Poland and Germany, with references to a careerfinder[.]ro domain and a Knighting[.]Pro file used in the infection chain. The analysis highlights the attackers’ ability to combine staged PowerShell, memory injection and process replacement to deliver RATs while remaining difficult to detect.