780th Military Intelligence Brigade (Cyber) (@780thmibdecyber.bsky.social)

GoLoader at Industrial Scale: Two Unauthenticated Builder Panels, 468K Polymorphic Samples, Steganographic .NET Loaders, and a Cracked njRAT Config Pointing to a Chinese XWorm Operator Breakglass Intelligence intel.breakglass.tech/post/goloade...

loading . . .

GoLoader at Industrial Scale: Two Unauthenticated Builder Panels, 468K Polymorphic Samples, Steganographic .NET Loaders, and a Cracked njRAT Config Pointing to a Chinese XWorm Operator Two GoLoader panels with zero authentication are churning out 468K+ polymorphic Windows malware samples targeting Chinese crypto investors. We reversed steganographic payloads, cracked the njRAT AES-2... https://intel.breakglass.tech/post/goloader-polymorphic-builder-panels-stego-njrat-xworm-laohe