Cloudeye

Cloudeye, also known as GuLoader, is a sophisticated malware that has been active for over three years and continues to evolve. First spotted in late 2019, it is an advanced shellcode-based malware downloader used to distribute a range of payloads, such as information stealers, while incorporating numerous anti-analysis techniques to evade traditional security solutions. The malware, which delivers additional malware such as infostealers and Remote Access Trojans (RATs), has been observed targeting various sectors, including US law firms, healthcare, and investment firms. The malware's connection with CloudEyE and the VgoStore was initially overlooked due to the distribution of GuLoader under an alternative name, "The Protector". However, further investigation revealed a close relationship between VgoStore and Remcos, another malicious software. In 2020, it was discovered that an Italian company was selling the CloudEyE product through the website securitycode.eu, revealing its direct affiliation with GuLoader. Despite claims by developers that Remcos and GuLoader are legitimate software, cybersecurity researchers found truly malicious payloads within them, identified as Amadey Loader and corresponding GuLoader shellcodes that load and decrypt these payloads. Researchers have been tracking the GuLoader campaign since April 2023 and noted its active targeting of specific sectors. Future research will focus on extracting download URLs and encryption keys from unpacked samples using Malduck, a digital forensics tool.