Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses

**Makop ransomware campaigns**: Acronis TRU analysis shows Makop (Phobos variant) continues to target exposed RDP with brute-force access, stages off‑the‑shelf network scanners, credential dumpers and numerous local privilege escalation exploits, and increasingly uses loaders like GuLoader to deploy payloads; observed tooling, regionally tailored AV uninstallers (notably Quick Heal), and multiple CVEs exploited are documented along with extensive IOCs and detection notes.