Fake Employee Performance Reports Deliver Guloader Malware

A phishing campaign impersonating internal HR communications sends a RAR archive containing an NSIS executable named to look like a PDF; executing it launches Guloader which fetches a second-stage payload from Google Drive and installs the Remcos RAT (C2 observed at 196.251.116.219 on ports 2404 and 5000). The report describes the social‑engineering lure, infection chain, observed IOCs, and recommended mitigations including visible file extensions, phishing training, advanced email/endpoint detection, MFA, and prompt incident reporting.