CherryLoader: A New Go-based Loader Discovered in Recent Intrusions

Arctic Wolf Labs details 'CherryLoader', a Go-based modular downloader observed in active intrusions that decrypts and loads publicly available privilege-escalation tools (PrintSpoofer and JuicyPotatoNG) using XOR and AES, employs process ghosting to evade detection, and establishes persistence by creating an admin account, disabling Defender, and enabling RDP; the report includes technical analysis, decryption scripts, and IOCs (IPs and SHA256 hashes) for detection and response.