RedLoader
RedLoader is a custom malware used by the financially motivated GOLD BLADE threat group, also tracked as RedCurl, Red Wolf, and Earth Kapre. It is deployed via DLL side-loading using legitimately signed Adobe executables, including renamed ADNotificationManager.exe, and has been observed in infection chains delivered through job-themed lures. In the July 2025 chain documented by Sophos, a cover-letter PDF sent via third-party job platforms such as Indeed led victims to a ZIP archive containing a malicious LNK file disguised as a PDF. The LNK launched conhost.exe, used WebDAV to retrieve a remotely hosted renamed Adobe executable from automatinghrservices[.]workers[.]dev, and sideloaded a malicious DLL named netutils.dll as RedLoader stage 1. Stage 1 created a scheduled task named BrowserQE\BrowserQE_<Base64-encoded computer name>, downloaded a standalone stage 2 executable from live[.]airemoteplant[.]workers[.]dev, and executed it via PCALua.exe and conhost.exe. RedLoader transmits information about the infected host to remote command-and-control infrastructure, communicates with its C2 server, and executes PowerShell scripts to gather information about the compromised Active Directory environment. Reported infrastructure and indicators include automatinghrservices[.]workers[.]dev, quiet[.]msftlivecloudsrv[.]workers[.]dev, live[.]airemoteplant[.]workers[.]dev, stage 1 filename netutils.dll, stage 1 SHA256 d302836c7df9ce8ac68a06b53263e2c685971781a48ce56b3b5a579c5bba10cc, and stage 2 SHA256 f5203c7ac07087fd5029d83141982f0a5e78f169cdc4ab9fc097cc0e2981d926.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
RedLoader stage 1 creates a scheduled task named ‘BrowserQE\BrowserQE _<Base64-encoded computer name> ’ on the victim’s system and downloads a standalone executable for stage 2.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
Sophos analysts are investigating a new infection chain for the GOLD BLADE cybercriminal group’s custom RedLoader malware, which initiates command and control (C2) communications... RedLoader stage 2 communicates with its C2 server.
IOCs tracked for this family
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom loader used by GOLD BLADE/RedCurl that is side-loaded via legitimately signed Adobe executables, communicates with C2, and launches PowerShell-based reconnaissance against the victim environment, including Active Directory discovery.
Custom malware used by GOLD BLADE as a multi-stage loader. It is delivered via a malicious LNK file that remotely executes and sideloads a benign executable to load the stage 1 DLL, establishes persistence via a scheduled task, downloads a standalone stage 2 executable, and then initiates C2 communications.
Custom malware used by GOLD BLADE as part of an infection chain. It is delivered via a malicious LNK file, uses remote DLL sideloading with a renamed benign executable, establishes persistence through a scheduled task, downloads a stage 2 executable, and then communicates with its C2 server.
A custom loader used by RedCurl/Gold Blade to collect system and Active Directory information, send it to C2, and deliver additional payloads, including ransomware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.