MalwarePublished 31 Jul 2025

GOLD BLADE remote DLL sideloading attack deploys RedLoader

Source AlienVault OTX General

Description

A new infection chain for GOLD BLADE's RedLoader malware has been identified, combining previously separate techniques. The attack begins with a malicious PDF link, leading to a ZIP archive containing a LNK file masquerading as a PDF. This file executes conhost.exe, which uses WebDAV to contact a CloudFlare domain and remotely sideload a malicious DLL. The infection progresses through two stages of RedLoader, ultimately establishing command and control communication. This updated method, observed in July 2025, demonstrates the threat actors' ability to adapt and bypass defenses by combining known techniques in novel ways.

Impact

For European organizations, the GOLD BLADE RedLoader infection chain represents a medium to high risk due to its stealthy execution and multi-stage payload delivery. The use of legitimate Windows binaries (conhost.exe) for DLL sideloading complicates detection by traditional antivirus and endpoint detection and response (EDR) solutions. Successful compromise could lead to unauthorized access, data theft, espionage, or disruption of critical services. Given the use of phishing and social engineering to initiate the attack, organizations with large user bases or those that frequently handle PDF documents are particularly vulnerable. The establishment of encrypted C2 channels enables persistent and covert communication, increasing the difficulty of incident response and remediation. The attack's reliance on CloudFlare domains for payload hosting may complicate attribution and takedown efforts. European entities in sectors such as finance, government, healthcare, and critical infrastructure could face significant operational and reputational damage if targeted. Additionally, the evolving nature of the attack chain indicates that threat actors are actively refining their tactics, which may lead to broader adoption and increased attack frequency in the near future.

Defensive guidance

1. Implement advanced email filtering and phishing detection solutions to block malicious PDF links and ZIP attachments before reaching end users. 2. Educate users on the risks of opening unexpected attachments, especially those masquerading as PDFs but are actually LNK files. 3. Employ application whitelisting and restrict execution of LNK files from email or untrusted directories. 4. Monitor and restrict the use of conhost.exe and other signed Windows binaries for anomalous network activity, particularly WebDAV requests to unusual external domains. 5. Deploy endpoint detection and response (EDR) tools capable of detecting DLL sideloading and process injection techniques. 6. Use network monitoring to identify suspicious outbound connections to CloudFlare worker domains or other uncommon hosts. 7. Regularly audit and harden registry run keys and startup folders to prevent persistence mechanisms. 8. Maintain up-to-date threat intelligence feeds and indicators of compromise (IOCs) to enable rapid detection and response. 9. Consider network segmentation and least privilege principles to limit lateral movement if a system is compromised. 10. Conduct regular security awareness training focusing on social engineering and spear-phishing tactics.

Indicators of compromise

Domains 3

automatinghrservices.workers.dev
quiet.msftlivecloudsrv.workers.dev
live.airemoteplant.workers.dev

Hashes 3

d302836c7df9ce8ac68a06b53263e2c685971781a48ce56b3b5a579c5bba10cc
f5203c7ac07087fd5029d83141982f0a5e78f169cdc4ab9fc097cc0e2981d926
369acb06aac9492df4d174dbd31ebfb1e6e0c5f3

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Jul 2025, 15:33 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Domains 3

Hashes 3

Community reviews

Related threats