The cybersecurity researchers at Morphisec Labs have been tracking the GuLoader campaign since April of this year and found that it has been actively targeting the law firms that are based in the US along with several other sectors like:- Healthcare Investment firms Targeted sectors (Source – Morphisec) For more than three years, GuLoader (aka ‘Cloudeye’) has been active, still keeps evolving, and employs diverse anti-analysis methods, posing challenges to security analysts to analyze it. GuLoader, infamous for distributing multiple malware families, such as:- NetWire Lokibot Xloader Remcos The GuLoader downloads the payload by using trusted platforms like:- Google Drive OneDrive GCloud In this campaign, the operators of GuLoader used ‘github.io’ as the download source to deliver the Remcos RAT (remote access trojan).

Source: GBHackers