July 11, 2024

GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

Cado Security Labs identified a GuLoader campaign targeting European industrial companies via spearphishing emails with compressed batch files. This malware uses obfuscated PowerShell scripts and shellcode with anti-debugging techniques to establish persistence and inject into legitimate processes, to deliver Remote Access Trojans. GuLoader's ongoing evolution highlights the need for robust security.

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Tara Gould

Malware Research Lead

Jul 2024

Introduction: GuLoader

Researchers from Cado Security Labs (now part of Darktrace) recently discovered a campaign targeting European industrial and engineering companies. GuLoader is an evasive shellcode downloader used to deliver Remote Access Trojans (RAT) that has been used by threat actors since 2019 and continues to advance. 

Initial access

Cado identified a number of spearphishing emails sent to electronic manufacturing, engineering and industrial companies in European countries including Romania, Poland, Germany and Kazakhstan. The emails typically include order inquiries and contain an archive file attachment (iso, 7z, gzip, rar). The emails are sent from various email addresses including from fake companies and compromised accounts. The emails typically hijack an existing email thread or request information about an order. 

PowerShell  

The first stage of GuLoader is a batch file that is compressed in the archive from the email attachment. As shown in Image 2, the batch file contains an obfuscated PowerShell script, which is done to evade detection.

The obfuscated script contains strings that are deobfuscated through a function “Boendes” (in this sample) that contains a for loop that takes every fifth character, with the rest of the characters being junk. After deobfuscating, the functionality of the script is clearer. These values can be retrieved by debugging the script, however deobfuscating with Script 1 in the Scripts section, makes it easier to read for static analysis.

Deobfuscated Powershell — Figure 3 - Deobfuscated PowerShell

This Powershell script contains the function “Aromastofs” that is used to invoke the provided expressions. A secondary file is downloaded from careerfinder[.]ro and saved as “Knighting.Pro” in the user’s AppData/Roaming folder. The content retrieved from “Kighting.Pro” is decoded from Base64, converted to ASCII and selected from position 324537, with the length 29555. This is stored as “$Nongalactic” and contains more Powershell. 

Second Powershell script — Figure 4 - Second PowerShell script

Deobfuscated Secondary Powershell — Figure 5 - Deobfuscated Secondary PowerShell

As seen in Image 5, the secondary PowerShell is obfuscated in the same manner as before with the function “Boendes”. The script begins with checking which PowerShell is being used 32 or 64 bit. If 64 bit is in use, a 32 bit PowerShell process is spawned to execute the script, and to enable 32 bit processes later in the chain. 

The function named “Brevsprkkernes” is a secondary obfuscation function. The function takes the obfuscated hex string, converts to a byte array, applies XOR with a key of 173 and converts to ASCII. This obfuscation is used to evade detection and analysis more difficult. Again, these values can be retrieved with debugging; however for readability, using Script 2 in the Scripts section makes it easier to read. 

Deobfuscated PowersShell Strings — Figure 7 - Deobfuscated PowerShell Strings

Figure 8: Deobfuscated Process Injection

The second PowerShell script contains functionality to allocate memory via VirtualAlloc and to execute shellcode. VirtualAlloc is a native Windows API function that allows programs to allocate, reserve, or commit memory in a specified process. Threat actors commonly use VirtualAlloc to allocate memory for malicious code execution, making it harder for security solutions to detect or prevent code injection. The variable “$Bakteriekulturs” contains the bytes that were stored in “AppData/Roaming/Knighting.Pro” and converted from Base64 in the first part of the PowerShell Script. Marshall::Copy is used to copy the first 657 bytes of that file, which is the first shellcode. Marshall.Copy is a method that enables the transfer of data between unmanaged memory and managed arrays, allowing data exchange between managed and unmanaged code. Marshal.Copy is typically abused to inject or manipulate malicious payloads in memory, bypassing traditional detection by directly accessing and modifying memory regions used by applications. Marshall::Copy is used again to copy bytes 657 to 323880 as a second shellcode. 

The first shellcode includes multiple anti-debugging techniques that make static and dynamic analysis difficult. There have been multiple evolutions of GuLoader’s evasive techniques that have been documented [1]. The main functionality of the first shellcode is to load and decrypt the second shellcode. The second shellcode adds the original PowerShell script as a Registry Key “Mannas” in HKCU/Software/Procentagiveless for persistence, with the path to PowerShell 32 bit executable stored as “Frenetic” in HKCU\Environment; however, these values change per sample. 

Figure 10 - Registry Key created for PowerShell Script

PowerShell bit added to Registry — Figure 11 - PowerShell 32 bit added to Registry

The second shellcode is injected into the legitimate “msiexec.exe” process and appears to be reaching out to a domain to retrieve an additional payload, however at the time of analysis this request returns a 404. Based on previous research of GuLoader, the final payload is usually a RAT including Remcos, NetWire, and AgentTesla.[2]

Figure 12  - msiexec abused to retrieve additional payload

Key Takeaway

Guloader malware continues to adapt its techniques to evade detection to deliver RATs. Threat actors are continually targeting specific industries in certain countries. Its resilience highlights the need for proactive security measures. To counter Guloader and other threats, organizations must stay vigilant and employ a robust security plan.

Scripts

Script 1 to deobfuscate junk characters 

import re 
import argparse 
import os 
 
def deobfuscate_powershell(input_file, output_file): 
  try: 
      with open(input_file, 'r', encoding='utf-8') as f: 
          text = f.read() 
 
      function_name_match = re.search(r"function\s+(\w+)\s*\(", text) 
      if not function_name_match: 
          print("Could not find the obfuscation function name in the file.") 
          return 
      
      function_name = function_name_match.group(1) 
      print(f"Detected obfuscation function name: {function_name}") 
 
      obfuscated_pattern = rf"(?<={function_name} ')(.*?)(?=')" 
      matches = re.findall(obfuscated_pattern, text) 
 
      for match in matches: 
          deobfuscated = match[4::5] 
          full_obfuscated_call = f"{function_name} '{match}'" 
          text = text.replace(full_obfuscated_call, deobfuscated) 
 
      with open(output_file, 'w', encoding='utf-8') as f: 
          f.write(text) 
 
      print(f"Deobfuscation complete. Output saved to {output_file}") 
 
  except Exception as e: 
      print(f"An error occurred!: {e}") 
 
if __name__ == "__main__": 
  parser = argparse.ArgumentParser(description="Deobfuscate an obfuscated PowerShell file.") 
  parser.add_argument("input_file", help="Path to the obfuscated PowerShell file.") 
  parser.add_argument("output_file", nargs='?', help="Path to save the deobfuscated file. Default is 'deobfuscated_powershell.ps1' in the same directory.", default=None) 
 
  args = parser.parse_args() 
 
  if args.output_file is None: 
      output_file = os.path.splitext(args.input_file)[0] + "_deobfuscated.ps1" 
  else: 
      output_file = args.output_file 
 
  deobfuscate_powershell(args.input_file, output_file)

Script 2 to deobfuscate hex strings obfuscation (note this will need values changed based on sample)

import re 
import argparse 
 
def brevsprkkernes(spackle): 
  if not all(c in '0123456789abcdefABCDEF' for c in spackle): 
      return f"Invalid hex: {spackle}" 
  
  paronomasian = 2 
  polyurethane = bytearray(len(spackle) // 2) 
 
  for forstyrrets in range(0, len(spackle), paronomasian): 
      try: 
          polyurethane[forstyrrets // 2] = int(spackle[forstyrrets:forstyrrets + 2], 16) 
          polyurethane[forstyrrets // paronomasian] ^= 173 
      except ValueError: 
          return f"Error processing hex: {spackle}" 
 
  return polyurethane.decode('ascii', errors='ignore') 
 
def process_file(input_file, output_file): 
  with open(input_file, 'r') as infile: 
      content = infile.read() 
 
  def replace_function(match): 
      hex_string = match.group(1).strip() 
      result = brevsprkkernes(hex_string) 
      return f"Brevsprkkernes '{result}'" 
 
  updated_content = re.sub(r"Brevsprkkernes\s*['\"]?([0-9A-Fa-f]+)['\"]?", replace_function, content) 
 
  with open(output_file, 'w') as outfile: 
      outfile.write(updated_content) 
 
if __name__ == "__main__": 
  parser = argparse.ArgumentParser(description="Process a PowerShell file and replace hex strings.") 
  parser.add_argument("input_file", help="Path to the input file.") 
  parser.add_argument("output_file", help="Path to save the deobufuscated file.") 
  
  args = parser.parse_args() 
 
  process_file(args.input_file, args.output_file)

Indicators of compromise (IoCs)

GuLoader scripts

ZW_PCCE-010023024001.bat 36a9a24404963678edab15248ca95a4065bdc6a84e32fcb7a2387c3198641374

ORDER_1ST.bat 26500af5772702324f07c58b04ff703958e7e0b57493276ba91c8fa87b7794ff

IMG465244247443 GULF ORDER Opmagasinering.cmd 40b46bae5cca53c55f7b7f941b0a02aeb5ef5150d9eff7258c48f92de5435216

EXSP 5634 HISP9005 ST MSDS DOKUME74247linierelet.bat e0d9ebe414aca4f6d28b0f1631a969f9190b6fb2cf5599b99ccfc6b7916ed8b3

LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat 4c697bdcbe64036ba8a79e587462960e856a37e3b8c94f9b3e7875aeb2f91959

Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat661f5870a5d8675719b95f123fa27c46bfcedd45001ce3479a9252b653940540

MEC20241022001.bat 33ed102236533c8b01a224bd5ffb220cecc32900285d2984d4e41803f1b2b58d

nMEC20241022001.iso 9617fa7894af55085e09a06b1b91488af37b8159b22616dfd5c74e6b9a081739

Gescanneerde lijst met artikelen nr. 654398.bat f5feabf1c367774dc162c3e29b88bf32e48b997a318e8dd03a081d7bfe6d3eb5

DHL_Shipping_Invoices_Awb_BL_000000000102220242247820020031808174Global180030010222024.cmd f78319fcb16312d69c6d2e42689254dff3cb875315f7b2111f5c3d2b4947ab50

Order Confirmation.bat 949cdd89ed5fb2da03c53b0e724a4d97c898c62995e03c48cbd8456502e39e57

SKM_0001810-01-2024-GL-3762.bat 9493ad437ea4b55629ee0a8d18141977c2632de42349a995730112727549f40e

21102024_0029_18102024_SKM_0001810-01-2024-GL-3762.iso 535dd8d9554487f66050e2f751c9f9681dadae795120bb33c3db9f71aafb472c

\Device\CdRom1\MARSS-FILTRY_ZW015010024.BAT e5ebe4d8925853fc1f233a5a6f7aa29fd8a7fa3a8ad27471c7d525a70f4461b6

Myologist.cmd 51244e77587847280079e7db8cfdff143a16772fb465285b9098558b266c6b3f

SKU_0001710-1-2024-SX-3762.bat 643cd5ba1ac50f5aa2a4c852b902152ffc61916dc39bd162f20283a0ecef39fe

Stamcafeernes.cmd 54b8b9c01ce6f58eb6314c67f3acb32d7c3c96e70c10b9d35effabb7e227952e

C:\Users\user\AppData\Local\Temp\j4phhdbc.lti\Bank details Form.bat c1f810194395ff53044e3ef87829f6dff63a283c568be4a83088483b6c043ec8

SKGCRO COMANDA FAB SRL M60_647746748846748347474.bat 8dd5fd174ee703a43ab5084fdaba84d074152e46b84d588bf63f9d5cd2f673d1

DHL_Shipping_Invoices_Awb_BL_000000000101620242247820020031808174Global180030010162024.bat bde5f995304e327d522291bf9886c987223a51a299b80ab62229fcc5e9d09f62

Ciwies.cmd b1be65efa06eb610ae0426ba7ac7f534dcb3090cd763dc8642ca0ede7a339ce7

Zamówienie Agotech Begyndelsesord.cmd 18c0a772f0142bc8e5fb0c8931c0ba4c9e680ff97d7ceb8c496f68dea376f9da

SKM_0001810-01-2024-GL-3762.iso 4a4c0918bdacd60e792a814ddacc5dc7edb83644268611313cb9b453991ac628

C:\Users\user\AppData\Local\Temp\Stemmeslugerens.bat 8bedbdaa09eefac7845278d83a08b17249913e484575be3a9c61cf6c70837fd2

Agotech Zamówienie Fjeldkammes325545235562377.bat ff6c4c8d899df66b551c84124e73c1f3ffa04a4d348940f983cf73b2709895d3

Agotech Zamówienie Fjeldkammes3255452355623.bat f3e046a7769b9c977053dd32ebc1b0e1bbfe3c61789d2b8d54e51083c3d0bed5

SKU_0001710-1-2024-SX-3762.iso 0546b035a94953d33a5c6d04bdc9521b49b2a98a51d38481b1f35667f5449326

SKU_0001710-1-2024-SX-3762.bat 4f1b5d4bb6d0a7227948fb7ebb7765f3eb4b26288b52356453b74ea530111520

DOKUMENTEN_TOBIAS.bat 038113f802ef095d8036e86e5c6b2cb8bc1529e18f34828bcf5f99b4cc012d6a

IMEG238668289485293885823085802835025Urfjeld.bat 6977043d30d8c1c5024669115590b8fd154905e01ab1f2832b2408d1dc811164

SKM_C250i24100408500.iso 6370cbcb1ac3941321f93dd0939d5daba0658fb8c85c732a6022cc0ec8f0f082

SKU_0001710-1-2024-SX-3762.iso 7f06382b781a8ba0d3f46614f8463f8857f0ade67e0f77606b8d918909ad37c2

\Device\CdRom1\ORDINE ELECTRICAS BC CORP PO EDC0969388.BAT e98fa3828fa02209415640c41194875c1496bc6f0ca15902479b012243d37c47

Quote Request #2359 Bogota.msg 0f0dfe8c5085924e5ab722fa01ea182569872532a6162547a2e87a1d2780f902

ORDER.1ST.bat 48dca5f3a12d3952531b05b556c30accafbf9a3c6cda3ec517e4700d5845ab61

Fortryl105.cmd f43b78e4dc3cba2ee9c6f0f764f97841c43419059691d670ca930ce84fb7143b

SMX-0002607-1-2024-UP-3762.iso a60dbbe88a1c4857f009a3c06a2641332d41dfd89726dd5f2c6e500f7b25b751

Quotation_final_buy_order_list_2024_po_nos_ART1256731610202400000000000.cmd efd80337104f2acde5c8f3820549110ad40f1aa9b494da9a356938103bda82e7

a60dbbe88a1c4857f009a3c06a2641332d41dfd89726dd5f2c6e500f7b25b751.iso 0327db7b754a16a7ae29265e7d8daed7a1caa4920d5151d779e96cd1536f2fbe

MARSS-FILTRY_ZW015010024.iso c415127bde80302a851240a169fff0592e864d2f93e9a21c7fd775fdb4788145

SKM_C250i24100408500.bat 36c464519a4cce8d0fcdb22a8974923fd51d915075eba9e62ade54a9c396844d

UPM-0002607-1-2024-UP-3762.iso e9fc754844df1a7196a001ac3dfbcf28b80397a718a3ceb8d397378a6375ff62

Comanda KOMARON TRADE SRL 435635Lukketid.bat 1bf09bcb5bfa440fc6ce5c1d3f310fb274737248bf9acdd28bea98c9163a745a

311861751714730477170144.bat f87448d722e160584e40feaad0769e170056a21588679094f7d58879cdb23623

Estimate_buy_product_purchase_order_import_list_10_10_2024_000000101024.cmd f20670ed0cdc2d9a2a75884548e6e6a3857bbf66cfbfb4afe04a3354da9067c9

PAYMENT TERM.bat 4c90504c86f1e77b0a75a1c7408adf1144f2a0e3661c20f2bf28d168e3408429

Arbitrre.cmd 8ef4cb5ad7d5053c031690b9d04d64ba5d0d90f7bf8ba5e74cb169b5388e92c5

KZЗапрос продукта SKM_32532667622352352Arvehygiejnikernes.bat 4ddd3369a51621b0009b6d993126fcb74b52e72f8cacd71fcbc401cda03108cb

Order_AP568.bat fda4e04894089be87f520144d8a6141074d63d33b29beb28fd042b0ecc06fbbc

C:\Users\user\Documents\ConnectWiseControl\Temp\Blodprocenternes.cmd e5f5d9855be34b44ad4c9b1c5722d1a6dff2f4a6878a874df1209d813aea7094

Productivenesses.cmd a7268e906b86f7c1bb926278bf88811cb12189de0db42616e5bbb3dc426a4ef5

Doktriner.cmd 74d468acd0493a6c5d72387c8e225cc0243ae1a331cd1e2d38f75ed8812347dd

final_buy_product_purchase_order_import_list_11_10_2024_000000111024.cmd a2127d63bc0204c17d4657e5ae6930cab6ab33ae3e65b82e285a8757f39c4da9

ORDER_U769.bat b45d9b5dbe09b2ca45d66432925842b0f698c9d269d3c7b5148cc26bdc2a92d0

Beschwerde-Rechtsanwalt.bat 229c4ce294708561801b16eed5a155c8cfe8c965ea99ac3cfb4717a35a1492f3

upit nr5634 10_08_2024.cmd 5854d9536371389fb0f1152ebc1479266d36ec4e06b174619502a6db1b593d71

C:\Users\user\AppData\Local\Temp\Doktriner.cmd 140dcb39308d044e3e90610c65a08e0abc6a3ac22f0c9797971f0c652bb29add

Fedtsyresammenstning.cmd 0b1c44b202ede2e731b2d9ee64c2ce333764fbff17273af831576a09fc9debfa

HENIKENPLANT PROJECT PROPOSAL BID_24-0976·pdf.cmd 31a72d94b14bf63b07d66d023ced28092b9253c92b6e68397469d092c2ffb4a6

MAIN ORDER.bat 85d1877ceda7c04125ca6383228ee158062301ae2b4e4a4a698ef8ed94165c7c

Narudzba ACH0036173.bat 8d7324d66484383eba389bc2a8a6d4e9c4cb68bfec45d887b7766573a306af68

Sludger.cmd 45b7b8772d9fe59d7df359468e3510df1c914af41bd122eeb5a408d045399a14

Glasmester.bat b0e69f895f7b0bc859df7536d78c2983d7ed0ac1d66c243f44793e57d346049d

PERMINTAAN ANGGARAN (Universitas IPB) ID177888·pdf.cmd 09a3bb4be0a502684bd37135a9e2cbaa3ea0140a208af680f7019811b37d28d6

C:\Users\user\Documents\ConnectWiseControl\Temp\Bidcock.cmd 0996e7b37e8b41ff0799996dd96b5a72e8237d746c81e02278d84aa4e7e8534e

PO++380.101483.bat a9af33c8a9050ee6d9fe8ce79d734d7f28ebf36f31ad8ee109f9e3f992a8d110

Network IOCs

91[.]109.20.161

137[.]184.191.215

185[.]248.196.6

hxxps://filedn[.]com/lK8iuOs2ybqy4Dz6sat9kSz/Frihandelsaftalen40.fla

hxxps://careerfinder[.]ro/vn/Traurigheder[.]sea

hxxp://inversionesevza[.]com/wp-includes/blocks_/Dekupere.pcz

hxxps://rareseeds[.]zendesk[.]com/attachments/token/G9SQnykXWFAnrmBcy8MzhciEs/?name=PO++380.101483.bat

Detection

Yara rule

rule GuLoader_Obfuscated_Powershell 
{ 
   meta: 
       description = "Detects Obfuscated GuLoader Powershell Scripts" 
       author = "[email protected]" 
       date = "2024-10-14" 
   strings: 
      $hidden_window = { 7374617274202f6d696e20706f7765727368656c6c2e657865202d77696e646f777374796c652068696464656e2022 } 
      $for_loop = /for\s*\(\s*\$[a-zA-Z0-9_]+\s*=\s*\d+;\s*\$[a-zA-Z0-9_]+\s*-lt\s*\$[a-zA-Z0-9_]+\s*;\s*\$[a-zA-Z0-9_]+\s*\+=\s*\d+\s*\)/ 
   condition: 
      $for_loop and $hidden_window

MITRE ATT&CK

T1566.001 Phishing: Malicious Attachment

T1055 Process Injection

T1204.002 User Execution: Malicious File

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

T1140 Deobfuscate/Decode Files or Information

T1622 Debugger Evasion

T1001.001 Junk Code

T1105 Ingress Tool Transfer

T1059.001 Command and Scripting Interpreter: Powershell

T1497.003  Virtualization/Sandbox Evasion: Time Based Evasion

T1071.001 Application Layer Protocol: Web Protocols

References:

[1] https://www.crowdstrike.com/en-us/blog/guloader-dissection-reveals-new-anti-analysis-techniques-and-code-injection-redundancy/

[2] https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/guloader-malware/

‍

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Written by

Tara Gould

Malware Research Lead

Malware Research Engineer

•

April 30, 2026

Andrew Hollister

Principal Solutions Engineer, Cyber Technician

Watch the NIS2 Webinar

Blog

AI

April 30, 2026

Mythos vs Ethos: Defending in an Era of AI‑Accelerated Vulnerability Discovery

Anthropic’s Mythos and what it means for security teams

Recent attention on systems such as Anthropic Mythos highlights a notable problem for defenders. Namely that disclosure’s role in coordinating defensive action is eroding.

As AI systems gain stronger reasoning and coding capability, their usefulness in analyzing complex software environments and identifying weaknesses naturally increases. What has changed is not attacker motivation, but the conditions under which defenders learn about and organize around risk. Vulnerability discovery and exploitation increasingly unfold in ways that turn disclosure into a retrospective signal rather than a reliable starting point for defense.

Faster discovery was inevitable and is already visible

The acceleration of vulnerability discovery was already observable across the ecosystem. Publicly disclosed vulnerabilities (CVEs) have grown at double-digit rates for the past two years, including a 32% increase in 2024 according to NIST, driven in part by AI even prior to Anthropic’s Mythos model. Most notably XBOW topped the HackerOne US bug bounty leaderboard, marking the first time an autonomous penetration tester had done so.

The technical frontier for AI capabilities has been described elsewhere as jagged, and the implication is that Mythos is exceptional but not unique in this capability. While Mythos appears to make significant progress in complex vulnerability analysis, many other models are already able to find and exploit weaknesses to varying degrees.

What matters here is not which model performs best, but the fact that vulnerability discovery is no longer a scarce or tightly bounded capability.

The consequence of this shift is not simply earlier discovery. It is a change in the defender-attacker race condition. Disclosure once acted as a rough synchronization point. While attackers sometimes had earlier knowledge, disclosure generally marked the moment when risk became visible and defensive action could be broadly coordinated. Increasingly, that coordination will no longer exist. Exploitation may be underway well before a CVE is published, if it is published at all.

Why patch velocity alone is not the answer

The instinctive response to this shift is to focus on patching faster, but treating patch velocity as the primary solution misunderstands the problem. Most organizations are already constrained in how quickly they can remediate vulnerabilities. Asset sprawl, operational risk, testing requirements, uptime commitments, and unclear ownership all limit response speed, even when vulnerabilities are well understood.

If discovery and exploitation now routinely precede disclosure, then patching cannot be the first line of defense. It becomes one necessary control applied within a timeline that has already shifted. This does not imply that organizations should patch less. It means that patching cannot serve as the organizing principle for defense.

Defense needs a more stable anchor

If disclosure no longer defines when defense begins, then defense needs a reference point that does not depend on knowing the vulnerability in advance.

Every digital environment has a behavioral character. Systems authenticate, communicate, execute processes, and access resources in relatively consistent ways over time. These patterns are not static rules or signatures. They are learned behaviors that reflect how an organization operates.

When exploitation occurs, even via previously unknown vulnerabilities, those behavioral patterns change.

Attackers may use novel techniques, but they still need to gain access, create processes, move laterally, and will ultimately interact with systems in ways that diverge from what is expected. That deviation is observable regardless of whether the underlying weakness has been formally named.

In an environment where disclosure can no longer be relied on for timing or coordination, behavioral understanding is no longer an optional enhancement; it becomes the only consistently available defensive signal.

Detecting risk before disclosure

Darktrace’s threat research has consistently shown that malicious activity often becomes visible before public disclosure.

In multiple cases, including exploitation of Ivanti, SAP NetWeaver, and Trimble Cityworks, Darktrace detected anomalous behavior days or weeks ahead of CVE publication. These detections did not rely on signatures, threat intelligence feeds, or awareness of the vulnerability itself. They emerged because systems began behaving in ways that did not align with their established patterns.

This reflects a defensive approach grounded in ‘Ethos’, in contrast to the unbounded exploration represented by ‘Mythos’. Here, Mythos describes continuous vulnerability discovery at speed and scale. Ethos reflects an understanding of what is normal and expected within a specific environment, grounded in observed behavior.

Revisiting assume breach

These conditions reinforce a principle long embedded in Zero Trust thinking: assume breach.

If exploitation can occur before disclosure, patching vulnerabilities can no longer act as the organizing principle for defense. Instead, effective defense must focus on monitoring for misuse and constraining attacker activity once access is achieved. Behavioral monitoring allows organizations to identify early‑stage compromise and respond while uncertainty remains, rather than waiting for formal verification.

AI plays a critical role here, not by predicting every exploit, but by continuously learning what normal looks like within a specific environment and identifying meaningful deviation at machine speed. Identifying that deviation enables defenders to respond by constraining activity back towards normal patterns of behavior.

Not an arms race, but an asymmetry

AI is often framed as fueling an arms race between attackers and defenders. In practice, the more important dynamic is asymmetry.

Attackers operate broadly, scanning many environments for opportunities. Defenders operate deeply within their own systems, and it’s this business context which is so significant. Behavioral understanding gives defenders a durable advantage. Attackers may automate discovery, but they cannot easily reproduce what belonging looks like inside a particular organization.

A changed defensive model

AI‑accelerated vulnerability discovery does not mean defenders have lost. It does mean that disclosure‑driven, patch‑centric models no longer provide a sufficient foundation for resilience.

As vulnerability volumes grow and exploitation timelines compress, effective defense increasingly depends on continuous behavioral understanding, detection that does not rely on prior disclosure, and rapid containment to limit impact. In this model, CVEs confirm risk rather than define when defense begins.

The industry has already seen this approach work in practice. As AI continues to reshape both offense and defense, behavioral detection will move from being complementary to being essential.

About the author

Andrew Hollister

Principal Solutions Engineer, Cyber Technician

Blog

Network

April 29, 2026

Darktrace Malware Analysis: Jenkins Honeypot Reveals Emerging Botnet Targeting Online Games

DDoS Botnet discovery

To observe adversary behavior in real time, Darktrace operates a global honeypot network known as “CloudyPots”, designed to capture malicious activity across a wide range of services, protocols, and cloud platforms. These honeypots provide valuable insights into the techniques, tools, and malware actively targeting internet‑facing infrastructure.

How attackers used a Jenkins honeypot to deploy the botnet

One such software honeypotted by Darktrace is Jenkins, a CI build system that allows developers to build code and run tests automatically. The instance of Jenkins in Darktrace’s honeypot is intentionally configured with a weak password, allowing attackers to obtain remote code execution on the service.

In one instance observed by Darktrace on March 18, 2026, a threat actor seemingly attempted to target Darktrace’s Jenkins honeypot to deploy a distributed denial-of-service (DDoS) botnet. Further analysis by Darktrace’s Threat Research team revealed the botnet was intended to specifically target video game servers.

How the Jenkins scriptText endpoint was used for remote code execution

The Jenkins build system features an endpoint named scriptText, which enables users to programmatically send new jobs, in the form of a Groovy script. Groovy is a programming language with similar syntax to Java and runs using the Java Virtual Machine (JVM). An attacker can abuse the scriptText endpoint to run a malicious script, achieving code execution on the victim host.

*Figure 1: Request sent to the scriptText endpoint containing the malicious script.*

The malicious script is sent using the form-data content type, which results in the contents of the script being URL encoded. This encoding can be decoded to recover the original script, as shown in Figure 2, where Darktrace Analysts decoded the script using CyberChef,

*Figure 2: The malicious script decoded using CyberChef.*

What happens after Jenkins is compromised

As Jenkins can be deployed on both Microsoft Windows and Linux systems, the script includes separate branches to target each platform.

In the case of Windows, the script performs the following actions:

Downloads a payload from 103[.]177.110.202/w.exe and saves it to C:\Windows\Temp\update.dat.
Renames the “update.dat” file to “win_sys.exe” (within the same folder)
Runs the Unblock-File command is used to remove security restrictions typically applied to files downloaded from the internet.
Adds a firewall allow rule is added for TCP port 5444, which the payload uses for command-and-control (C2) communications.

On Linux systems, the script will instead use a Bash one-liner to download the payload from 103[.]177.110.202/bot_x64.exe to /tmp/bot and execute it.

Why this botnet uses a single IP for delivery and command and control

The IP 103[.]177.110.202 belongs to Webico Company Limited, specifically its Tino brand, a Vietnamese company that offers domain registrar services and server hosting. Geolocation data indicates that the IP is located in Ho Chi Minh City. Open-source intelligence (OSINT) analysis revealed multiple malicious associations tied to the IP [1].

Darktrace’s analysis found that the IP 103[.]177.110.202 is used for multiple stages of an attack, including spreading and initial access, delivering payloads, and C2 communication. This is an unusual combination, as many malware families separate their spreading servers from their C2 infrastructure. Typically, malware distribution activity results in a high volume of abuse complaints, which may result in server takedowns or service suspension by internet providers. Separate C2 infrastructure ensures that existing infections remain controllable even if the spreading server is disrupted.

How the malware evades detection and maintains persistence

Analysis of the Linux payload (bot _x64)

The sample begins by setting the environmental variables BUILD_ID and JENKINS_NODE_COOKIE to “dontKillMe”. By default, Jenkins terminates long-running scripts after a defined timeout period; however, setting these variables to “dontKillMe” bypasses this check, allowing the script to continue running uninterrupted.

The script then performs several stealth behaviors to evade detection. First, it deletes the original executable from disk and then renames itself to resemble the legitimate kernel processes “ksoftirqd/0” or “kworker”, which are found on Linux installations by default. It then uses a double fork to daemonize itself, enabling it to run in the background, before redirecting standard input, standard output, and standard error to /dev/null, hiding any logging from the malware. Finally, the script creates a signal handler for signals such as SIGTERM, causing them to be ignored and making it harder to stop the process.

*Figure 3: Stealth component of the main function*

How the botnet communicates with command and control (C2)

The sample then connects to the C2 server and sends the detected architecture of the system on which the agent was installed. The malware then enters a loop to handle incoming commands.

The sample features two types of commands, utility commands used to manage the malware, and commands to trigger attacks. Three special commands are defined: “PING” (which replies with PONG as a keep-alive mechanism), “!stop” which causes the malware to exit, and “!update”, which triggers the malware to download a new version from the C2 server and restart itself.

*Figure 4: Initial connection to the C2 sever.*

What DDoS attack techniques this botnet uses

The attack commands consist of the following:

Many of these commands invoke the same function despite appearing to be different attack techniques. For example, specialized attacks such as Cloudflare bypass (cfbypass, uam) use the exact same function as a standard HTTP attack. This may indicate the threat actor is attempting to make the botnet look like it has more capabilities than it actually has, or it could suggest that these commands are placeholders for future attack functionality that has yet to be implemented

All the commands take three arguments: IP, port to attack, and the duration of the attack.

attack_udp and attack_udp_pps

The attack_udp and attack_udp_pps functions both use a basic loop and sendto system call to send UDP packets to the victim’s IP, either targeting a predetermined port or a random port. The attack_udp function sends packets with 1,450 bytes of data, aimed at bandwidth saturation, while the attack_udp_pps function sends smaller 64-byte packets. In both cases, the data body of the packet consists of entirely random data.

*Figure 5: Code for the UDP attack method*

attack_dayz

The attack_dayz function follows a similar structure to the attack_udp function; however, instead of sending random data, it will instead send a TSource Engine Query. This command is specific to Valve Source Engine servers and is designed to return a large volume of data about the targeted server. By repeatedly flooding this request, an attacker can exhaust the resources of a server using a comparatively small amount of data.

The Valve Source Engine server, also called Source Engine Dedicated server, is a server developed by video game company Valve that enables multiplayer gameplay for titles built using the Source game engine, which is also developed by Valve. The Source engine is used in games such as Counterstrike and Team Fortress 2. Curiously, the function attack_dayz, appears to be named after another popular online multiplayer game, DayZ; however, DayZ does not use the Valve Source Engine, making it unclear why this name was chosen.

The code for the “attack_dayz” attack function. — *Figure 6: The code for the* “*attack_dayz” attack function.*

attack_tcp_push

The attack_tcp_push function establishes a TCP socket with the non-blocking flag set, allowing it to rapidly call functions such as connect() and send() without waiting for their completion. For the duration of the attack, it enters a while loop in which it repeatedly connects to the victim, sends 1,024 bytes of random data, and then closes the connection. This process repeats until the attack duration ends. If the mode flag is set to 1, the function also configures the socket with TCP no-delay enabled, allowing for packets to be sent immediately without buffering, resulting in a higher packet rate and a more effective attack.

*Figure 7: The code for the TCP attack function.*

attack_http

Similar to attach_tcp_push, attack_http configures a socket with no-delay enabled and non-blocking set. After establishing the connection, it sends 64 HTTP GET requests before closing the socket.

*Figure 8: The code for the HTTP attack function.*

attack_special

The attack_special function creates a UDP socket and sets the port and payload based on the value of the mode flag:

Mode 0: Port 53 (DNS), sending a 10-byte malformed data packet.
Mode 1: Port 27015 (Valve Source Engine), sending the previously observed TSource Engine Query packet.
Mode 2: Port 123 (NTP), sending the start of an NTP control request.

*Figure 9: The code for the attack_special function.*

What this botnet reveals about opportunistic attacks on internet-facing systems

Jenkins is one of the less frequently exploited services honeypotted by Darktrace, with only a handful campaigns observed. Nonetheless, the emergence of this new DDoS botnet demonstrates that attackers continue to opportunistically exploit any internet-facing misconfiguration at scale to grow the botnet strength.

While the hosts most commonly affected by these opportunistic attacks are usually “lower-value” systems, this distinction is largely irrelevant for botnets, where numbers alone are more important to overall effectiveness

The presence of game-specific DoS techniques further highlights that the gaming industry continues to be extensively targeted by cyber attackers, with Cloudflare reporting it as the fourth most targeted industry [2]. This botnet has likely already been used against game servers, serving as a reminder for server operators to ensure appropriate mitigations are in place.

Credit to Nathaniel Bill (Malware Research Engineer)
Edited by Ryan Traill (Content Manager)

Indicators of Compromise (IoCs)

103[.]177.110.202 - Attacker and command-and-control IP

F79d05065a2ba7937b8781e69b5859d78d5f65f01fb291ae27d28277a5e37f9b – bot_x64

References

[1] https://www.virustotal.com/gui/url/86db2530298e6335d3ecc66c2818cfbd0a6b11fcdfcb75f575b9fcce1faa00f1/detection

[2] - https://blog.cloudflare.com/ddos-threat-report-2025-q4/

About the author

Nathaniel Bill

Malware Research Engineer

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Guloader: Evolving Tactics in Latest Campaign Targeting European Industry

GuLoader: Evolving Tactics in Latest Campaign Targeting European Industry

Introduction: GuLoader

Initial access

PowerShell

Key Takeaway

Scripts

Indicators of compromise (IoCs)

GuLoader scripts

Network IOCs

Detection

Yara rule

MITRE ATT&CK

References:

Darktrace Malware Analysis: Jenkins Honeypot Reveals Emerging Botnet Targeting Online Games

Mythos vs Ethos: Defending in an Era of AI‑Accelerated Vulnerability Discovery

Enjoying the blog?

More in this series

Bringing Together SOC and IR teams with Automated Threat Investigations for the Hybrid World

Inside Cloud Compromise: Investigating Attacker Activity with Darktrace / Forensic Acquisition & Investigation

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Blog

AI

April 30, 2026

Mythos vs Ethos: Defending in an Era of AI‑Accelerated Vulnerability Discovery

Anthropic’s Mythos and what it means for security teams

Faster discovery was inevitable and is already visible

Why patch velocity alone is not the answer

Defense needs a more stable anchor

Detecting risk before disclosure

Revisiting assume breach

Not an arms race, but an asymmetry

A changed defensive model

Blog

Network

April 29, 2026

Darktrace Malware Analysis: Jenkins Honeypot Reveals Emerging Botnet Targeting Online Games

DDoS Botnet discovery

How attackers used a Jenkins honeypot to deploy the botnet

How the Jenkins scriptText endpoint was used for remote code execution

What happens after Jenkins is compromised

Why this botnet uses a single IP for delivery and command and control

How the malware evades detection and maintains persistence

How the botnet communicates with command and control (C2)

What DDoS attack techniques this botnet uses

attack_udp and attack_udp_pps

attack_dayz

attack_tcp_push

What this botnet reveals about opportunistic attacks on internet-facing systems

Indicators of Compromise (IoCs)

PowerShell  