Guloader Malware Rides Wave of Fake Performance Reports

ASEC warns of a phishing campaign that weaponizes layoff anxiety by sending fake HR performance review emails containing a RAR archive with an NSIS executable; executing the file runs Guloader which fetches shellcode from a Google Drive URL and ultimately deploys Remcos RAT, enabling keylogging, screenshots, webcam/microphone access and data exfiltration. The report includes an active C2 IP (196.251.116.219) using ports 2404 and 5000 and advises caution when opening attachments from unknown senders and regular password changes.